TRITON - Web Security Help, Version 7.7 - Websense

The Web Security DashboardThe Suspicious Event Summary can be customized to show or hide any of thefollowing columns. The columns displayed by default are marked with an asterisk (*).ColumnDescriptionSeverity* Indicated by an “S” icon with a blue background ( ).Shows the severity (Critical, High, Medium, or Low)assigned to the event.Forensics* Indicated by a magnifying glass icon ( ). Indicates whetherthe event included an attempt to send files.Web Security Gateway or Gateway Anywhere only.User* The user name (if any) associated with the activity.IP address The IP address of the machine on which the activityoccurred.Device* The name of the machine on which the activity occurred.Web Security Gateway or Gateway Anywhere only.Category* The Master Database category assigned to the activity.Last Attempt* The timestamp of the most recent event sharing all of thecharacteristics displayed in the row.Country* Indicated by the abbreviation “CC” (for country code).Shows the 2-letter country code for the event destination(target). If more than one destination is associated with anevent, “Multiple” is displayed.Direction Whether the suspicious activity involved inbound oroutbound traffic.Outbound threat detection requires Web Security Gatewayor Gateway Anywhere.Incidents*The number of incidents sharing all of the characteristicsdisplayed in the row except for “Last Attempt.”To add columns to the chart, or to remove columns, click the Customize link abovethe table. Mark or clear the check box next to a column name to add or remove thecolumn from the table.To export the contents of the table to a CSV file, click Export to CSV. Select the timeperiod for which to export event data, then click Export.Investigate threat event detailsTRITON - Web Security Help | Web Security Solutions | Version 7.7.xUse the Dashboard > Threats > Event Details page to research suspicious activityincidents. The page can show incidents related to:A specific user name, IP address, or device, selected from the Suspicious EventSummary table on the Threats dashboard. (Device name information is providedby Content Gateway, and is not available when other integrations are used.)TRITON - Web Security Help 37