[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

AW: [ISSForum] Reducing the number of events



Well, Jean Paul, you specifically mentioned the appliances, so I assumed that this feature was for the appliances. Will there be a new policy editor for those people with just the software?

Regards,

Jim Mohr


> -----Ursprüngliche Nachricht-----
> Von: Ballerini, Jean Paul (ISS EMEA) [mailto:JPBallerini@xxxxxxx] 
> Gesendet: Donnerstag, 18. November 2004 14:20
> An: Mohr James; issforum@xxxxxxxxxxxxxxxx
> Betreff: RE: [ISSForum] Reducing the number of events
> 
> 
> Jim,
> 
> I don't understand what you mean exactly.
> SiteProtector users will get the Service Packs and keep 
> working as always. Anything particular in mind?
> 
> Jean Paul
> 
> -----Original Message-----
> From: issforum-bounces@xxxxxxxxxxxxxxxx On Behalf Of Mohr James
> Sent: Wednesday, November 17, 2004 3:14 PM
> To: issforum@xxxxxxxxxxxxxxxx
> Subject: AW: [ISSForum] Reducing the number of events
> 
> How does the affect SiteProtector users. (My fault for not 
> specifying which product I had)
> 
> Regards,
> 
> Jim Mohr
> 
> > -----Ursprüngliche Nachricht-----
> > Von: Ballerini, Jean Paul (ISS EMEA) [mailto:JPBallerini@xxxxxxx]
> > Gesendet: Mittwoch, 17. November 2004 13:55
> > An: Mohr James; issforum@xxxxxxxxxxxxxxxx
> > Betreff: RE: [ISSForum] Reducing the number of events
> > 
> > 
> > That is why the new policy editor is being developed.
> > On the next G400/G2000 release that will be possible; next
> > year it will become possible on all appliances.
> > 
> > Regards,
> > 
> > Jean Paul
> > 
> > -----Original Message-----
> > From: Mohr James [mailto:james.mohr@xxxxxxxxx]
> > Sent: Wednesday, November 17, 2004 10:43 AM
> > To: Ballerini, Jean Paul (ISS EMEA); issforum@xxxxxxxxxxxxxxxx
> > Subject: AW: [ISSForum] Reducing the number of events
> > 
> > That means I have to go through every single event and
> > configure it individually. I was hoping for something global 
> > where I could say to simply ignore *all* low severity events.
> > 
> > Regards,
> > 
> > Jim Mohr
> > 
> > > -----Ursprüngliche Nachricht-----
> > > Von: Ballerini, Jean Paul (ISS EMEA) [mailto:JPBallerini@xxxxxxx]
> > > Gesendet: Mittwoch, 17. November 2004 09:08
> > > An: Mohr James; issforum@xxxxxxxxxxxxxxxx
> > > Betreff: RE: [ISSForum] Reducing the number of events
> > > 
> > > 
> > > Yes,
> > > 
> > > But it is a little long to explain.
> > > Look at the advanced parameters of the events under event 
> > > propagation. That is where you can reduce the number of 
> alert (and 
> > > data stored) per event. You'll have to use LogFiltered instead of 
> > > LogWithoutRaw.
> > > 
> > > Jean Paul
> > > 
> > > -----Original Message-----
> > > From: issforum-bounces@xxxxxxxxxxxxxxxx On Behalf Of Mohr James
> > > Sent: Tuesday, November 16, 2004 12:44 PM
> > > To: issforum@xxxxxxxxxxxxxxxx
> > > Subject: [ISSForum] Reducing the number of events
> > > 
> > > Hi All!
> > > 
> > > My boss wants to significantly reduce the number of 
> events that are 
> > > sent from a number of sensors. I know you can disable specific 
> > > events, but is there anyway to say that you do not want any low 
> > > priority events at all. I know how to change the view in 
> the console 
> > > to not display low severity, but I my boss does not want them to 
> > > even get sent to the event collector. Is there any way to do this?
> > > 
> > > Regards,
> > > 
> > > Jim Mohr
> > > 
> > > _______________________________________________
> > > ISSForum mailing list
> > > ISSForum@xxxxxxx
> > > 
> > > TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-> 
> > > mm1.iss.net/mailman/listinfo/issforum
> > > 
> > > To
> > > contact the
> > > ISSForum Moderator, send email to mod-issforum@xxxxxxx
> > > 
> > > The ISSForum mailing list is hosted and managed by 
> Internet Security 
> > > Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
> > > 
> > > 
> > > 
> > 
> > 
> > 
> 
> _______________________________________________
> ISSForum mailing list
> ISSForum@xxxxxxx
> 
> TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to 
> https://atla-> mm1.iss.net/mailman/listinfo/issforum
> 
> To 
> contact the 
> ISSForum Moderator, send email to mod-issforum@xxxxxxx
> 
> The ISSForum mailing list is hosted and managed by Internet 
> Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
> 
> 
> 

_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.