[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

AW: [ISSForum] Reducing the number of events



How does the affect SiteProtector users. (My fault for not specifying which product I had)

Regards,

Jim Mohr

> -----Ursprüngliche Nachricht-----
> Von: Ballerini, Jean Paul (ISS EMEA) [mailto:JPBallerini@xxxxxxx] 
> Gesendet: Mittwoch, 17. November 2004 13:55
> An: Mohr James; issforum@xxxxxxxxxxxxxxxx
> Betreff: RE: [ISSForum] Reducing the number of events
> 
> 
> That is why the new policy editor is being developed.
> On the next G400/G2000 release that will be possible; next 
> year it will become possible on all appliances.
> 
> Regards,
> 
> Jean Paul
> 
> -----Original Message-----
> From: Mohr James [mailto:james.mohr@xxxxxxxxx] 
> Sent: Wednesday, November 17, 2004 10:43 AM
> To: Ballerini, Jean Paul (ISS EMEA); issforum@xxxxxxxxxxxxxxxx
> Subject: AW: [ISSForum] Reducing the number of events
> 
> That means I have to go through every single event and 
> configure it individually. I was hoping for something global 
> where I could say to simply ignore *all* low severity events.
> 
> Regards,
> 
> Jim Mohr
> 
> > -----Ursprüngliche Nachricht-----
> > Von: Ballerini, Jean Paul (ISS EMEA) [mailto:JPBallerini@xxxxxxx]
> > Gesendet: Mittwoch, 17. November 2004 09:08
> > An: Mohr James; issforum@xxxxxxxxxxxxxxxx
> > Betreff: RE: [ISSForum] Reducing the number of events
> > 
> > 
> > Yes,
> > 
> > But it is a little long to explain.
> > Look at the advanced parameters of the events under event
> > propagation. That is where you can reduce the number of alert 
> > (and data stored) per event. You'll have to use LogFiltered 
> > instead of LogWithoutRaw.
> > 
> > Jean Paul
> > 
> > -----Original Message-----
> > From: issforum-bounces@xxxxxxxxxxxxxxxx On Behalf Of Mohr James
> > Sent: Tuesday, November 16, 2004 12:44 PM
> > To: issforum@xxxxxxxxxxxxxxxx
> > Subject: [ISSForum] Reducing the number of events
> > 
> > Hi All!
> > 
> > My boss wants to significantly reduce the number of events
> > that are sent from a number of sensors. I know you can 
> > disable specific events, but is there anyway to say that you 
> > do not want any low priority events at all. I know how to 
> > change the view in the console to not display low severity, 
> > but I my boss does not want them to even get sent to the 
> > event collector. Is there any way to do this?
> > 
> > Regards,
> > 
> > Jim Mohr
> > 
> > _______________________________________________
> > ISSForum mailing list
> > ISSForum@xxxxxxx
> > 
> > TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
> > https://atla-> mm1.iss.net/mailman/listinfo/issforum
> > 
> > To
> > contact the 
> > ISSForum Moderator, send email to mod-issforum@xxxxxxx
> > 
> > The ISSForum mailing list is hosted and managed by Internet
> > Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
> > 
> > 
> > 
> 
> 
> 

_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.