[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[ISSForum] Correlation with Fusion Module

Hi All,

I have the Fusion module installed on a server that also hosts the RSSP database. The SP console, EC, application server and server controller are installed on another server.

I'm using System Scanner on a dedicated server to perform the VA scans.
I have entered all of my Server Sensor IPs in the Fusion policy and
configured it to perform correlation using the "most recent scan results"
and the ignore vulnerability information is set to 90 days.
When running the VA scans I used all of the initial policies and a few of
my customized policies. All of my servers have been scanned at least once
in the past 90 days, some 2-3 times.

Is it normal to see only 6% of correlation in the Event Analysis view?
Most of the status is; Unknown impact (no correlation)
The "Load Analysis View "is set at; Event Analysis - Event Name

I was expecting to see a lot more correlation than this.

Any comments regarding this subject would be appreciated,
Thank you,

Jean Levert
Corporate Security - Security Operations
Sûreté de l'entreprise - Opérations
Tel: (613)-244-6179
Pager: (613)-783-5298

ISSForum mailing list

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.