Wanguard 6.2 User Guide
Configuration » Components » Sensor Cluster
Configuration » Components »
Sensor Cluster
Sensor Cluster
aggregates traffic data provided by Packet Sensors and Flow Sensors into a single anomaly
detection domain and/or IP graphing domain.
To add a Sensor Cluster, click the <+> button found on the title bar of the Configuration » Components panel.
To configure an existing Sensor Cluster, go to Configuration » Components, and click its name.
The
Sensor Cluster Configuration
window contains the following fields:
●
Sensor Name
– A short name to help you identify the Sensor Cluster.
●
Graph Color
– The color used in graphs for the Sensor Cluster. The default color is a random one, which
can be changed by entering a different HTML color code or by clicking the drop-down menu.
●
Reports Visibility
– Enable if the Sensor Cluster should be listed inside Reports » Components.
●
Device Group
– Optional description used within Console to group up components (e.g. by location or
role). It can be used to restrict the access of Guest accounts.
●
Sensor Server
– The server that runs the Sensor Cluster. It is recommended to run Sensor Clusters on
the Console server. The configuration of servers is described on page 37.
●
Link Speed IN / OUT
– The summed-up speeds (bandwidth, capacity) of the aggregated interfaces. The
values are used for percentage-based reports and percentage-based bits/s thresholds.
●
Associated Sensors
– Select which Packet Sensors and Flow Sensor interfaces must be aggregated by the
Sensor Cluster.
●
IP Zone
– Sensor Cluster extracts from the selected IP Zone per-subnet settings about thresholds and/or
IP graphing. For more information about IP Zones consult the “IP Zone” chapter on page 34.
●
Anomaly Detection
– Select “Aggregated” to enable anomaly detection in the summed up traffic data by
the Sensor Cluster, and disable anomaly detection by associated Sensors. Select “Not Aggregated” to
enable anomaly detection by each associated Sensor and to disable anomaly detection by the Sensor
Cluster. Enable aggregation only when the associated Sensors use Wanguard licenses, not WanSight.
Select “Duplicated” to enable anomaly detection in the summed up traffic data by the Sensor Cluster,
and also to enable anomaly detection by associated Sensors.
●
IP Graphing
– Select “Aggregated” to enable IP graphing by the Sensor Cluster for the summed up traffic
data, and disable IP graphing by the associated Sensors. Select “Not Aggregated” to enable IP graphing
by each associated Sensor and to disable IP graphing by the Sensor Cluster.
●
Comments
– Comments about the Sensor Cluster can be saved here. These observations are not visible
elsewhere.
To start the Sensor Cluster, click the gray square button next to its name in Configuration » Components.
Ensure that the Sensor Cluster starts correctly by watching the event log (details on page 69) and by
monitoring Reports » Components » Overview.
- 50 -
Summary of Contents for wanguard 6.2
Page 1: ......
