Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...

Ranking
The Ranking system provides a way to quantify the importance of DPI and Firewall Events. By assigning
"asset values" to Computers, and assigning "severity values" to DPI Rules and Firewall Rules, the
importance ("Rank") of an Event is calculated by multiplying the two values together. This allows you to
sort Events by Rank when viewing DPI or Firewall Events.
Firewall Rule Severity Values
Severity values for Firewall Rules are linked to their actions: Deny, Log Only, and Packet Rejection. (The
latter refers to packets rejected because of a stateful configuration setting.) Use this panel to edit the
severity values which will be multiplied by a Computer„s asset value to determine the rank of a Firewall
Event. (Firewall Rule actions can viewed and edited in the Rule's Properties window.)
DPI Rule Severity values
DPI Rule Severity Values are linked to their severity levels: Critical, High, Medium, or Low. Use this panel
to edit their values which will be multiplied by a Computer„s asset value to determine the rank of a DPI
Event. A DPI Rule's severity setting can be viewed in the Rule's Properties window.
Computer Asset Values
Computer Asset Values are not associated with any of their other properties like DPI Rules or Firewall
Rules. Instead, Computer Asset Values are properties in themselves. A Computer's Asset Value can be
viewed and edited from the Computer's Details window. To simplify the process of assigning asset values,
you can predefine some values that will appear in the Asset Importance drop-down list in the first
screen of the Computer's Details window. To view existing predefined Computer Asset Values, click the
View Asset Values... button in this panel. The Asset Values window displays the predefined settings.
These values can be changed, and new ones can be created. (New settings will appear in the drop-down
list for all Computers.)
© Copyright 2010 Trend Micro Inc. www.trendmicro.com
All rights reserved. - 68 -