Using The Incident Generator Service - McAfee M-1250 - Network Security Platform Configuration Manual

McAfee® Network Security Platform 5.1
Figure 67: Global Auto Acknowledgement Setting
2
3
4
5

Using the Incident Generator service

The
enables creation of attack incident conditions, which, when met, provide real-time
correlative analysis of attacks. Installation includes the service application as well as
configuration and log files.
Real-time alert correlation is the analysis of past (recently detected) and future (incoming)
alerts to determine if a set of specific conditions, or a scenario, is being met that may
identify a repeat offender/target or a vulnerability in your network. A scenario can be
customized to research attacks that originate from any source, target a single host, or
other such patterns. The minimum set of conditions are as follows:
•
•
•
•
IG service maintains multiple counts for multiple source or destination IPs. When the
threshold conditions within a scenario are met, the system triggers an incident.
For example, you can configure an incident to be 100 attacks intended for any destination
IP detected within 5 minutes. Within the 5 minute interval, 116 attacks are detected
targeting the destination IP 192.168.5.3, as well as 145 attacks targeting 192.168.5.4. Two
separate incidents are recorded as there were two destination IP addresses that met the
Enable Global Auto ACK.
This is enabled by default for a fresh install of Network Security Platform.
Specify the severity level of the attacks that you want to be auto acknowledged.
For example, if you specify 2 (Low) then Manager will consider all attacks with a
severity level of 2 or less. The default value is 3 (Low).
Specify whether you want to auto acknowledge attacks that are recommended by
McAfee for blocking (RFB). The default selection is 'No'.
Save
Click to save the changes you made.
Incident Generator
action installs and starts the Incident Generator (IG) service. This
Source IP Destination IP
or : any source or destination IP address by default.
Threshold Value
: number of attacks to be detected within the
considered an incident. The default is 10 attacks.
Threshold Interval
: length of time when the Threshold Value must be breached to be
considered an incident. The default is 5 minutes. The starting time is considered to be
when the first attack was detected. Thus, the ending time is when the last attack was
detected.
Period of Quiet
: length, or gap, in time in which no alerts matching the conditions occur.
The default is 2 minutes.
67
Managing IPS settings
Threshold Interval
to be