That is why the new policy editor is being developed.
On the next G400/G2000 release that will be possible; next year it will become
possible on all appliances.
Regards,
Jean Paul
-----Original Message-----
From: Mohr James [mailto:james.mohr@elaxy.com]
Sent: Wednesday, November 17, 2004 10:43 AM
To: Ballerini, Jean Paul (ISS EMEA); issforum@atla-mm1.iss.net
Subject: AW: [ISSForum] Reducing the number of events
That means I have to go through every single event and configure it
individually. I was hoping for something global where I could say to simply
ignore *all* low severity events.
Regards,
Jim Mohr
-----Ursprüngliche Nachricht-----
Von: Ballerini, Jean Paul (ISS EMEA) [mailto:JPBallerini@iss.net]
Gesendet: Mittwoch, 17. November 2004 09:08
An: Mohr James; issforum@atla-mm1.iss.net
Betreff: RE: [ISSForum] Reducing the number of events
Yes,
But it is a little long to explain.
Look at the advanced parameters of the events under event
propagation. That is where you can reduce the number of alert
(and data stored) per event. You'll have to use LogFiltered
instead of LogWithoutRaw.
Jean Paul
-----Original Message-----
From: issforum-bounces@atla-mm1.iss.net On Behalf Of Mohr James
Sent: Tuesday, November 16, 2004 12:44 PM
To: issforum@atla-mm1.iss.net
Subject: [ISSForum] Reducing the number of events
Hi All!
My boss wants to significantly reduce the number of events
that are sent from a number of sensors. I know you can
disable specific events, but is there anyway to say that you
do not want any low priority events at all. I know how to
change the view in the console to not display low severity,
but I my boss does not want them to even get sent to the
event collector. Is there any way to do this?
Regards,
Jim Mohr
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-> mm1.iss.net/mailman/listinfo/issforum
To
contact the
ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet
Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
