Table of Contents
Advertisement
Marking and annotating
Click Show Both to show all events relating to the selected incident.
■
3
In Maximum Events to Display, enter a value. The default is 100 events per
incident.
4
Click Apply to save and exit.
Note: All users can select event filtering criteria. See
page 319 for more about permissions.
See also
"About operational event notices"
The Network Security console provides a way to keep track of your examination
of the incidents by marking incidents as read and adding notes about them.
See
"Marking incidents as read"
■
See
"Annotating incident data"
■
See
"Customizing annotation templates"
■
Marking incidents as read
All users can mark incidents to distinguish new incidents from reviewed
incidents.
To mark incidents already viewed
1
On the Incidents tab, right-click an incident.
2
In the pop-up list, click Mark Incident.
The Marked column of the incident displays a red hash mark to
indicate that it has been viewed.
Note: If an incident changes after it was marked, such as a new event being
added to it, the red hash mark changes to a red circle to flag you.
Note: All users can mark incident data. See
for more about permissions.
Managing incident and event data
"User groups reference"
on page 199.
on page 207.
on page 208.
on page 208.
"User groups reference"
Monitoring
207
on
on page 319
Advertisement
Table of Contents
