HP X Unified Security Platform Series Bedienungsanleitung PDF herunterladen (Seite 117)

Logs

X Family LSM User’s Guide V 2.5.1 101

IPS Block Log

The IPS Block log contains information about packets that have triggered an IPS filter configured with

a Block + Notify action set.

To maintain a complete history of entries and provide a backup, you can configure the X family device

to send IPS Block Log entries to a remote syslog server from the Notification Contacts page. For details,

see the “

Notification Contacts” on page 52.

An IPS Block log entry contains the following fields:

Component The area in which the user perform an action (LOGIN, LOGOUT and Launch Bar

Tab s )

Result The action performed or the result of a LOGIN or LOGOUT attempt

Action The action performed as a result. For example, Log Files Reset.

Table 5–2: Audit Log Field Descriptions (Continued)

Column Description

Table 5–3: IPS Block Log Field Descriptions

Column Description

Log ID A system-assigned Log ID number

Date/Time A date and time stamp in the format

YYYY-MM-DD HH:MM:SS

Severity Indicates the severity of the triggered filter. Possible values include:

Low = 1

Minor = 2

Major=3

Critical=4

Note When the log is downloaded, the Severity value is reported

using the numerical value.

Filter Name The name of the filter that was triggered

Protocol The name of the protocol that the action affects

Security Zone

(pair)

The Security Zone pair where the alert occurred (LAN to WAN, for example)

Source Address The source address of the triggering traffic

Dest Address The destination address of the triggering traffic

Packet Trace Details if a packet trace is available

Hit Count Details how many packets have been detected

1 2 ... 112 113 114 115 116 117 118 119 120 121 122 ... 332 333

Keine Kommentare

HP X Unified Security Platform Series Bedienungsanleitung Seite 117