142 Responding
Setting response actions
Setting no response action
The
None
option directs Symantec Network Security not to respond to
particular types of incidents. Selecting the None option, followed by Stop as the
next action configures Symantec Network Security to take no action in response
to specified types of incidents. SuperUsers and Administrators can also
configure Symantec Network Security to ignore specific attacks by setting a
filter.
To enable None response actions
1
In the Network Security console, click
Configuration
>
Response Rules
.
2
In
Response Rules
, click the
Response Action
column of a rule.
3
In
Configure Response Action
, click
None
.
4
In
Configure Response Action
, click
OK
to save and exit.
5
In
Response Rules
, click
OK
to save and exit.
Setting email notification
Alerting is a standard component of most intrusion detection systems because
security analysts must be kept informed of attack activity without having to
constantly monitor the Network Security console. Unfortunately, many IDS
products use the same interface for detection as for notification. In such a
configuration, a flood attack could prevent the console from sending email
notifications because the flood attack would overload the interface.
Symantec Network Security uses a separate, independent interface for
notification, thus enabling the Network Security console to successfully send
email notification even during an attack.
This section describes the following topics:
■
Setting email notification response actions
■
Setting email notification parameters
Setting email notification response actions
The email response action enables you to customize using variables in the
subject line. The minimum delay between responses is 1 minute.
To enable email notifications
1
In the Network Security console, click
Configuration
>
Network Security
Parameters
.
2
In
Response Rules
, click the
Response Action
column of a rule.
Summary of Contents for 10521146 - Network Security 7120
Page 1: ...Symantec Network Security Administration Guide...
Page 12: ...12 Contents Index...
Page 14: ...14...
Page 70: ...70...
Page 110: ...110 Populating the topology database Adding nodes and objects...
Page 158: ...158 Responding Managing flow alert rules...
Page 188: ...188...
Page 242: ...242 Reporting Playing recorded traffic...
Page 268: ...268 Managing log files Exporting data...
Page 316: ...316 Advanced configuration Configuring advanced parameters...
Page 318: ...318...
Page 338: ...338 SQL reference Using MySQL tables...
Page 366: ...366 Glossary...
Page 392: ...392 Index...
