Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...

Firewall Events
By default, the IDF Server Plug-in collects Firewall and DPI Event logs from the IDF Client Plug-ins at
every heartbeat. (This can be turned off from the Firewall and DPI tab on the System > System
Settings screen.) The data from the logs is used to populate the various reports, graphs, and charts in
the IDF Server Plug-in.
Once collected by the IDF Server Plug-in, Event logs are kept for a period of time which can be set from
System tab on the System > System Settings screen. The default setting is one week.
Firewall Event icons:
Single Event
Single Event with data
Folded Event
Folded Event with data
Event folding occurs when multiple events of the same type occur in succession. This saves disk
space and protects against DoS attacks that may attempt to overload the logging mechanism.
From the main screen you can:
View ( ) the properties of a particular event
Filter the list: Use the Period and Computer toolbars to filter the list of events
Export ( ) the event list data to a CSV file
Search ( ) for a particular event
Additionally, right-clicking a log entry gives you the option to:
Computer Details: View the Details screen of the Computer that generated the log entry
Firewall Rule Properties: View the all the properties of a particular log entry on open
Properties window
Whois Source IP: Perform a whois on the source IP
Whois Destination IP: Perform a whois query on the destination IP
Columns for the Firewall Events display:
Time: Time the event took place on the Computer.
Computer: The Computer on which this event was logged. (If the Computer has been removed,
this entry will read "Unknown Computer".)
Reason: Log entries on this screen are generated either by Firewall Rules or by Stateful
Configuration settings. If an entry is generated by a Firewall Rule, the column entry will be
prefaced by "Firewall Rule:" followed by the name of the Firewall Rule. Otherwise the column
entry will display the Stateful Configuration setting that generated the log entry. (For a listing of
possible packet rejection reasons, see "Packet Rejection Reasons" in the Reference section of this
help module.)
Action: The action taken by the Firewall Rule or Stateful Configuration. Possible actions are:
Allow, Deny, Force Allow, and Log Only.
Rank: The Ranking system provides a way to quantify the importance of DPI and Firewall Events.
By assigning "asset values" to Computers, and assigning "severity values" to DPI Rules and
Firewall Rules, the importance ("Rank") of an Event is calculated by multiplying the two values
together. This allows you to sort Events by Rank when viewing DPI or Firewall Events.
Direction: The direction of the affected packet (incoming or outgoing).
© Copyright 2010 Trend Micro Inc. www.trendmicro.com
All rights reserved. - 28 -