Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...

Firewall IP Activity (Prevented)
Firewall History (2x1)
Select the checkbox beside each of the three widgets, and click OK. The widgets will appear on the
dashboard. (It may take a bit of time to generate the data.)
The Firewall Activity (Prevented) widget displays a list of the most common reasons for
packets to be denied (that is, blocked from reaching a Computer by the Client Plug-in on that
Computer) along with the number of packets that were denied. Items in this list will be either
types of Packet Rejections or Firewall Rules. Each "reason" is a link to the corresponding logs for
that denied packet.
The Firewall IP Activity (Prevented) widget displays a list of the most common source IPs of
denied packets. Similar to the Firewall Activity (Prevented) widget, each source IP is a link to
the corresponding logs.
The Firewall History (2x1) widget displays a bar graph indicating how many packets were
blocked (prevented) or only logged (detected) in the last 24 hour period or seven day period
(depending on the view selected). Clicking a bar will display the corresponding logs for the period
represented by the bar.
Note the trend indicators next to the numeric values in the Firewall Activity (Prevented) and
Firewall IP Activity (Prevented) widgets. An upward or downward pointing triangle indicates an
overall increase or decrease over the specified time period, and a flat line indicates no significant
change.
Logs of Firewall and DPI Events
Now drill-down to the logs corresponding to the top reason for Denied Packets: in the Firewall Activity
(Prevented) widget, click the first reason for denied packets (in the picture above, the top reason is "Out
of Allowed Policy"). This will take you to the Firewall Events screen.
The Firewall Events screen will display all Firewall Events where the Reason column entry corresponds
to the first reason from the Firewall Activity (Prevented) widget ("Out of Allowed Policy"). The logs are
filtered to display only those events that occurred during the view period of the Dashboard (Last 24 hours
or last seven days). Further information about the Firewall Events and DPI Events page can be found in
the help pages for those screens.
For the meaning of the different packet rejection reasons, see Firewall Events and DPI Events.
Reports
Often, a higher-level view of the log data is desired, where the information is summarized, and presented
in a more easily understood format. The Reports fill this role, allowing you to display detailed summaries
on Computers, Firewall and DPI Event Logs, Events, Alerts, etc. On the Reports screen, you can select
various options for the report to be generated. These options are further discussed in the Reports help
section.
We will generate a Firewall Report, which displays a record of Firewall Rule and Stateful Configuration
activity over a configurable date range. Select Firewall Report from the Report drop-down. Click
Generate to launch the report in a new window.
By reviewing reports, by logging into the system and consulting the dashboard, by performing detailed
investigations by drilling-down to specific logs, and by configuring alerts to notify you of critical events,
you can remain apprised of the health and status of your network.
© Copyright 2010 Trend Micro Inc. www.trendmicro.com
All rights reserved. - 121 -