Table of Contents
Advertisement
Event Correlation 'Destination IP' Weight
Event Correlation 'Source Port' Weight
4
In the lower right pane, enter a value between 0 and 10.
5
Click Apply.
6
In Apply Changes To, select the node to which to apply the parameter.
7
Click OK to save the changes to this node and close.
Event Correlation 'Destination IP' Weight determines the weight of the event
name as a factor in event correlation.
The default value is set to 4 for optimum performance in a typical enterprise
deployment. Valid values range from 0 to 10, inclusive. A value of 0 means the
event name will be completely ignored during correlation. A value of 10 means
that a matching name alone is sufficient to correlate events.
Note: Make sure that the sum of all Event correlation Weight values is equal to
or greater than 10. If the sum is less than 10, no events will be correlated.
Caution: Before making changes, we recommend that you consult our support
team at
http://www.symantec.com/techsupp/enterprise
To configure this parameter
1
Click Configuration > Node > Network Security Parameters.
2
In Select Node, choose the node from the pull-down list, and click OK.
3
In the left pane, click Event Correlation 'Destination IP' Weight.
4
In the lower right pane, enter a value between 0 and 10.
5
Click Apply.
6
In Apply Changes To, select the node to which to apply the parameter.
7
Click OK to save the changes to this node and close.
Event Correlation 'Source Port' Weight determines the weight of the event name
as a factor in event correlation.
The default value is set to 4 for optimum performance in a typical enterprise
deployment. Valid values range from 0 to 10, inclusive. A value of 0 means the
Monitoring
Tuning incident parameters
217
Advertisement
Table of Contents
