Selecting View Filters - Symantec 10521146 - Network Security 7120 Administration Manual

Selecting view filters

See the following for further information:
See "About incident/event reports"
■
See "Interpreting severity and confidence levels"
■
The Network Security console provides a way to adjust the view by selecting
filters to display only a relevant subset of the total incident or event tables.
See "Selecting incident filters"
■
See "Selecting event filters"
■
Selecting incident filters
You can filter the view of incident data to provide a shorter list to sift through,
using the Incident Filter. For example, you can set the Incidents table to display
only active incidents. You can choose between viewing the incidents detected by
all software and appliance nodes, and viewing only those detected by a particular
software or appliance node. By default, incidents from all nodes are displayed.
Note: When you apply incident view filters, they apply only to the incidents, not
to the events correlated to the incidents. For example, even if you select the
Sensor Only filter, an operational event that is correlated to a sensor incident will
still be displayed.
To filter the view of incidents or events
1
In the Incidents tab, in the upper Incidents pane, click Filters.
2
Click Hide Closed Incidents to show only active incidents in the cluster.
3
In Incident Class, do one of the following:
Click Hide All Operational to show only those incidents classified as
■
sensor events, and filter out all operational notice events.
Click Hide Sensor to show only operational events, such as Network
■
Security console logins.
Click Show All Operational and Sensor to show both operational and
■
sensor events.
4
In Marked State, do one of the following:
Click Hide Unmarked to show only the incidents that have been marked
■
in the Network Security console.
Managing incident and event data
on page 229.
on page 197.
on page 205.
on page 206.
Monitoring 205