Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...

DPI Events
By default, the IDF Server Plug-in collects Firewall and DPI Event logs from the IDF Client Plug-ins at
every heartbeat. (This can be turned off from the Firewall and DPI tab on the System > System
Settings screen.) The data from the logs is used to populate the various reports, graphs, and charts in
the IDF Server Plug-in.
Once collected by the IDF Server Plug-in, Event logs are kept for a period of time which can be set from
System tab on the System > System Settings screen. The default setting is one week.
From the main screen you can:
View ( ) the properties of a particular event
Filter the list: Use the Period and Computer toolbars to filter the list of events
Export ( ) the event log data to a CSV file
Search ( ) for a particular event
Additionally, right-clicking a log entry gives you the option to:
Computer Details: View the Details screen of the Computer that generated the log entry
DPI Rule Properties: View the all the properties of a particular log entry on open Properties
window
Whois Source IP: Perform a whois on the source IP
Whois Destination IP: Perform a whois on the destination IP
Columns for the DPI Events display:
Time: Time the event took place on the Computer.
Computer: The Computer on which this event was logged. (If the Computer has been removed,
this entry will read "Unknown Computer".)
Reason: The DPI Rule associated with this event.
Application Type: The Application Type associated with the the DPI Rule which caused this
event."
Action: What action the DPI Rule took (Allow, Deny, Force Allow, Log Only, or Detect Only (if the
rule is in Detect Only mode)).
Rank: The Ranking system provides a way to quantify the importance of DPI and Firewall Events.
By assigning "asset values" to Computers, and assigning "severity values" to DPI Rules and
Firewall Rules, the importance ("Rank") of an Event is calculated by multiplying the two values
together. This allows you to sort Events by Rank when viewing DPI or Firewall Events.
Direction: The direction of the packet (incoming or outgoing)
Interface: The MAC address of the interface through which the packet was passing.
Protocol: Possible values are "ICMP", "IGMP", "GGP", "TCP", "PUP", "UDP", "IDP", "ND", "RAW",
"TCP+UDP", AND "Other: nnn" where nnn represents a three digit decimal value.
Flags: Flags set in the packet.
Source IP: The packet's source IP.
Source MAC: The packet's source MAC address.
Source Port: The packet's source port.
Destination IP: The packet's destination IP address.
Destination MAC: The packet's destination MAC address.
Destination Port: The packet's destination port.
Packet Size: The size of the packet in bytes.
© Copyright 2010 Trend Micro Inc. www.trendmicro.com
All rights reserved. - 39 -