18.07.2013 Views

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Configuring alarm events and event responses<br />

STRIKEBACK—Select the name <strong>of</strong> the Strikeback event response<br />

that contains the Strikeback actions you want performed if an<br />

alarm is triggered. The default Strikeback event response will issue<br />

the dig command. Select None if you do not want a Strikeback to<br />

occur.<br />

SNMP Trap—Select this check box if you want to issue an SNMP<br />

trap if an alarm is triggered. See Chapter 14 for details about SNMP.<br />

4. Select the Enabled check box to enable this alarm event. A check mark<br />

appears when the event is enabled. (To disable this alarm event at any<br />

time, de-select this check box.)<br />

5. In the Threshold field, type the number <strong>of</strong> times this type <strong>of</strong> event must<br />

occur before an alarm will be triggered. Valid values include any nonzero,<br />

positive integer.<br />

6. In the Event Period field, type the number <strong>of</strong> seconds during which the<br />

number <strong>of</strong> events specified in the Threshold field must occur before an<br />

alarm will be triggered. Valid values include zero (which indicates<br />

infinity) or any positive integer.<br />

For example, if you have configured an alarm event to filter for netprobe<br />

attempts, and you want to trigger an alarm event if 5 or more probe<br />

attempts occur within 30 a second period, you would select 5 in the<br />

Threshold field, and 30 in the Event Period field. If you do not enter an<br />

event period, a zero value (which indicates infinity) is used as the<br />

default.<br />

7. In the Alarm Interval field, type the number <strong>of</strong> seconds to wait once an<br />

alarm has been triggered before another alarm can be triggered for the<br />

same event type. Valid values include any non-zero, positive integer (in<br />

seconds).<br />

For example, suppose you configure an alarm event to trigger when 5<br />

or more probe attempts occur in 30 second period, and you configure<br />

an Alarm Interval value <strong>of</strong> 300 seconds (five minutes).<br />

In this configuration, if an intruder launches 5 probe attempts in a 30<br />

second period, an alarm event is triggered. However, if the intruder<br />

sends 5 more probe attempts during the next 30 seconds, a new alarm<br />

will not be triggered. After five minutes, if the threshold is again<br />

reached, another alarm will be triggered.<br />

Alarm Events and Responses 17-7

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!