[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: [ISSForum] Reducing the number of events



I see.

To date it is foreseen only for the appliances because we want to keep the same code-base on all of them. 
It is not yes decided whether or not the policy editor will be change for the software sensors as well. It will probably depend on how much market demand there is -- as always.

Regards,

Jean Paul

-----Original Message-----
From: issforum-bounces@xxxxxxxxxxxxxxxx On Behalf Of Mohr James
Sent: Thursday, November 18, 2004 5:01 PM
To: issforum@xxxxxxxxxxxxxxxx
Subject: AW: [ISSForum] Reducing the number of events

Well, Jean Paul, you specifically mentioned the appliances, so I assumed that this feature was for the appliances. Will there be a new policy editor for those people with just the software?

Regards,

Jim Mohr


> -----Ursprüngliche Nachricht-----
> Von: Ballerini, Jean Paul (ISS EMEA) [mailto:JPBallerini@xxxxxxx] 
> Gesendet: Donnerstag, 18. November 2004 14:20
> An: Mohr James; issforum@xxxxxxxxxxxxxxxx
> Betreff: RE: [ISSForum] Reducing the number of events
> 
> 
> Jim,
> 
> I don't understand what you mean exactly.
> SiteProtector users will get the Service Packs and keep 
> working as always. Anything particular in mind?
> 
> Jean Paul
> 
> -----Original Message-----
> From: issforum-bounces@xxxxxxxxxxxxxxxx On Behalf Of Mohr James
> Sent: Wednesday, November 17, 2004 3:14 PM
> To: issforum@xxxxxxxxxxxxxxxx
> Subject: AW: [ISSForum] Reducing the number of events
> 
> How does the affect SiteProtector users. (My fault for not 
> specifying which product I had)
> 
> Regards,
> 
> Jim Mohr
> 
> > -----Ursprüngliche Nachricht-----
> > Von: Ballerini, Jean Paul (ISS EMEA) [mailto:JPBallerini@xxxxxxx]
> > Gesendet: Mittwoch, 17. November 2004 13:55
> > An: Mohr James; issforum@xxxxxxxxxxxxxxxx
> > Betreff: RE: [ISSForum] Reducing the number of events
> > 
> > 
> > That is why the new policy editor is being developed.
> > On the next G400/G2000 release that will be possible; next
> > year it will become possible on all appliances.
> > 
> > Regards,
> > 
> > Jean Paul
> > 
> > -----Original Message-----
> > From: Mohr James [mailto:james.mohr@xxxxxxxxx]
> > Sent: Wednesday, November 17, 2004 10:43 AM
> > To: Ballerini, Jean Paul (ISS EMEA); issforum@xxxxxxxxxxxxxxxx
> > Subject: AW: [ISSForum] Reducing the number of events
> > 
> > That means I have to go through every single event and
> > configure it individually. I was hoping for something global 
> > where I could say to simply ignore *all* low severity events.
> > 
> > Regards,
> > 
> > Jim Mohr
> > 
> > > -----Ursprüngliche Nachricht-----
> > > Von: Ballerini, Jean Paul (ISS EMEA) [mailto:JPBallerini@xxxxxxx]
> > > Gesendet: Mittwoch, 17. November 2004 09:08
> > > An: Mohr James; issforum@xxxxxxxxxxxxxxxx
> > > Betreff: RE: [ISSForum] Reducing the number of events
> > > 
> > > 
> > > Yes,
> > > 
> > > But it is a little long to explain.
> > > Look at the advanced parameters of the events under event 
> > > propagation. That is where you can reduce the number of 
> alert (and 
> > > data stored) per event. You'll have to use LogFiltered instead of 
> > > LogWithoutRaw.
> > > 
> > > Jean Paul
> > > 
> > > -----Original Message-----
> > > From: issforum-bounces@xxxxxxxxxxxxxxxx On Behalf Of Mohr James
> > > Sent: Tuesday, November 16, 2004 12:44 PM
> > > To: issforum@xxxxxxxxxxxxxxxx
> > > Subject: [ISSForum] Reducing the number of events
> > > 
> > > Hi All!
> > > 
> > > My boss wants to significantly reduce the number of 
> events that are 
> > > sent from a number of sensors. I know you can disable specific 
> > > events, but is there anyway to say that you do not want any low 
> > > priority events at all. I know how to change the view in 
> the console 
> > > to not display low severity, but I my boss does not want them to 
> > > even get sent to the event collector. Is there any way to do this?
> > > 
> > > Regards,
> > > 
> > > Jim Mohr
> > > 
> > > _______________________________________________
> > > ISSForum mailing list
> > > ISSForum@xxxxxxx
> > > 
> > > TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-> 
> > > mm1.iss.net/mailman/listinfo/issforum
> > > 
> > > To
> > > contact the
> > > ISSForum Moderator, send email to mod-issforum@xxxxxxx
> > > 
> > > The ISSForum mailing list is hosted and managed by 
> Internet Security 
> > > Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
> > > 
> > > 
> > > 
> > 
> > 
> > 
> 
> _______________________________________________
> ISSForum mailing list
> ISSForum@xxxxxxx
> 
> TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to 
> https://atla-> mm1.iss.net/mailman/listinfo/issforum
> 
> To 
> contact the 
> ISSForum Moderator, send email to mod-issforum@xxxxxxx
> 
> The ISSForum mailing list is hosted and managed by Internet 
> Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
> 
> 
> 

_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.



_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.