Viewing Aggregate Normalized Events - Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT REV 1 Manual

Viewing Aggregate
Normalized Events
The raw events window results provides the following information:
Table 3-5 Raw Events Parameters
Parameter Description
Current Filters The top of the table displays the details of the filter applied to the
search results. To clear these filter values, click Clear Filter.
Start Time Specifies the time of the first event, as reported to STRM Log
Management by the device.
Device Specifies the device that originated the event.
Payload Specifies the original event payload information in UTF-8 format.
Using the Event Viewer, you can view events aggregated (grouped) by various
options.
Table 3-6 Aggregate Normalized Events
Aggregate Option
Event Name
Source IP
Destination IP
Source Port
Destination Port
STRM Log Management Users Guide
Description
Displays a summarized list of events grouped by the
normalized name of the event.
Displays a summarized list of events grouped by the source
IP address of the event.
Displays a summarized list of events grouped by the
destination IP address of the event.
Displays a summarized list of events grouped by the source
port address of the event.
Displays a summarized list of events grouped by the
destination port address of the event.
Viewing Events 21