[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

AW: [ISSForum] Reducing the number of events



That means I have to go through every single event and configure it individually. I was hoping for something global where I could say to simply ignore *all* low severity events.

Regards,

Jim Mohr

> -----Ursprüngliche Nachricht-----
> Von: Ballerini, Jean Paul (ISS EMEA) [mailto:JPBallerini@xxxxxxx] 
> Gesendet: Mittwoch, 17. November 2004 09:08
> An: Mohr James; issforum@xxxxxxxxxxxxxxxx
> Betreff: RE: [ISSForum] Reducing the number of events
> 
> 
> Yes,
> 
> But it is a little long to explain.
> Look at the advanced parameters of the events under event 
> propagation. That is where you can reduce the number of alert 
> (and data stored) per event. You'll have to use LogFiltered 
> instead of LogWithoutRaw.
> 
> Jean Paul
> 
> -----Original Message-----
> From: issforum-bounces@xxxxxxxxxxxxxxxx On Behalf Of Mohr James
> Sent: Tuesday, November 16, 2004 12:44 PM
> To: issforum@xxxxxxxxxxxxxxxx
> Subject: [ISSForum] Reducing the number of events
> 
> Hi All!
> 
> My boss wants to significantly reduce the number of events 
> that are sent from a number of sensors. I know you can 
> disable specific events, but is there anyway to say that you 
> do not want any low priority events at all. I know how to 
> change the view in the console to not display low severity, 
> but I my boss does not want them to even get sent to the 
> event collector. Is there any way to do this?
> 
> Regards,
> 
> Jim Mohr
> 
> _______________________________________________
> ISSForum mailing list
> ISSForum@xxxxxxx
> 
> TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to 
> https://atla-> mm1.iss.net/mailman/listinfo/issforum
> 
> To 
> contact the 
> ISSForum Moderator, send email to mod-issforum@xxxxxxx
> 
> The ISSForum mailing list is hosted and managed by Internet 
> Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
> 
> 
> 

_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.