Table of Contents
Advertisement
22
U
D
SING THE
ASHBOARD
Reports
Enterprise Security
State
The Reports option allows you to display the top recently generated reports. The
display provides the report title, the time and date the report was generated, and
the format of the report.
The Enterprise Security State represents your network's current security posture.
The security state is formulated from monitoring the security data from flows,
external events, and security data to create a single metric that reveals the security
health of your network. The Enterprise Security State is a graphical representation
of the following calculated weighted averages:
Attacker Threat Posing - The value applied to the threat that an attacker
•
poses over time. The magnitudes of all offenses that involved the attacker
during the interval are added together. This value is then added to the value of
the previous interval and stored as the new threat posed by the attacker. STRM
then scales this value based on the maximum threat posing in the database to a
weight value (0 to 10). This value is reported by the Magistrate component and
is calculated each interval.
Target Threat Under - The value applied to the threat a target is under over
•
time. For each offense in which the target is involved during the interval, an
average of the offense category is accumulated and added together to obtain a
value. This value is then added to the previous interval value and stored as the
new threat under for the target. STRM then scales this value based on the
maximum threat under in the database to a weight value (0 to 10). This value is
reported by the Magistrate component and is calculated each interval.
Network Threat Posing - The value applied to the threat a network poses
•
during a 15 minute interval. This is calculated by summing the threat posing for
all attackers seen on that network during an interval and then calculating an
averaged weighted value (0 to 10). This value is calculated each interval.
Network Threat Under - The value applied to the threat a network is under
•
during a 15 minute interval. This is calculated by summing the threat under for
all attackers seen on that network during an interval and then calculating an
averaged weighted value (0 to 10). This value is calculated each interval.
STRM Users Guide
Advertisement
Table of Contents
