Ignoring Events - Internet Security Systems RealSecure User Manual

Chapter 4: Configuring RealSecure Desktop Protector

Ignoring Events

Ignoring an existing
event type
Ignore an event
type in advance
40
You can configure RealSecure Desktop Protector to ignore events that are not a threat to
your system.
Ignoring an event is different from trusting an intruder. Ignoring disregards certain
Note:
kinds of events. When an event type is ignored, Desktop Protector does not log any
information about events of that type. Trusting excludes an address from intrusion
detection. Intrusions from that address are not shown on the Events tab.
To ignore an event type:
1. On the Events tab, right-click the event/intruder combination.
2. On the shortcut menu, select Ignore Event.
3. From the submenu, select one of the following:
This Event: The BlackICE intrusion detection component ignores all future
I
instances of the event.
This Event by this Intruder: The BlackICE intrusion detection component ignores
I
all future instances of this event by the referenced intruder.
4. Click Yes.
Desktop Protector adds the event to the list of ignored events on the Detection tab in the
BlackICE Settings window.
When you know of a potential event but haven't seen that type of event yet, and you want
Desktop Protector to allow the event, you can preemptively ignore the event type. For
example, you may want to ignore future HTTP port scans from your Internet Service
Provider. Follow these steps:
1. From the Main Menu, select Tools
2. Select Intrusion Detection.
3. Click Add.
The Exclude from Reporting window appears.
4. Do one of the following:
To ignore future events of a specific type, go to Step 5.
I
To ignore future events from a specific intruder, go to Step 6.
I
5. Select All in the Addresses to Trust area, and then go to Step 8.
6. Type the IP address of the intruder in the IP box.
Use standard 000.000.000.000 notation.
I
If you are specifying a range of IP addresses, place a dash between them. For
I
example, 192.168.10.23–192.168.10.32 .
7. In the Attacks to Ignore area, clear the All check box.
The system enables the Name and ID boxes, and disables the Add Firewall Entry
check box.
8. Select the event type in the Name box, or select the event number in the ID box.
9. Click Add.
Edit BlackICE Settings.