Well, Jean Paul, you specifically mentioned the appliances, so I assumed that
this feature was for the appliances. Will there be a new policy editor for
those people with just the software?
Regards,
Jim Mohr
-----Ursprüngliche Nachricht-----
Von: Ballerini, Jean Paul (ISS EMEA) [mailto:JPBallerini@iss.net]
Gesendet: Donnerstag, 18. November 2004 14:20
An: Mohr James; issforum@atla-mm1.iss.net
Betreff: RE: [ISSForum] Reducing the number of events
Jim,
I don't understand what you mean exactly.
SiteProtector users will get the Service Packs and keep
working as always. Anything particular in mind?
Jean Paul
-----Original Message-----
From: issforum-bounces@atla-mm1.iss.net On Behalf Of Mohr James
Sent: Wednesday, November 17, 2004 3:14 PM
To: issforum@atla-mm1.iss.net
Subject: AW: [ISSForum] Reducing the number of events
How does the affect SiteProtector users. (My fault for not
specifying which product I had)
Regards,
Jim Mohr
-----Ursprüngliche Nachricht-----
Von: Ballerini, Jean Paul (ISS EMEA) [mailto:JPBallerini@iss.net]
Gesendet: Mittwoch, 17. November 2004 13:55
An: Mohr James; issforum@atla-mm1.iss.net
Betreff: RE: [ISSForum] Reducing the number of events
That is why the new policy editor is being developed.
On the next G400/G2000 release that will be possible; next
year it will become possible on all appliances.
Regards,
Jean Paul
-----Original Message-----
From: Mohr James [mailto:james.mohr@elaxy.com]
Sent: Wednesday, November 17, 2004 10:43 AM
To: Ballerini, Jean Paul (ISS EMEA); issforum@atla-mm1.iss.net
Subject: AW: [ISSForum] Reducing the number of events
That means I have to go through every single event and
configure it individually. I was hoping for something global
where I could say to simply ignore *all* low severity events.
Regards,
Jim Mohr
-----Ursprüngliche Nachricht-----
Von: Ballerini, Jean Paul (ISS EMEA) [mailto:JPBallerini@iss.net]
Gesendet: Mittwoch, 17. November 2004 09:08
An: Mohr James; issforum@atla-mm1.iss.net
Betreff: RE: [ISSForum] Reducing the number of events
Yes,
But it is a little long to explain.
Look at the advanced parameters of the events under event
propagation. That is where you can reduce the number of
alert (and
data stored) per event. You'll have to use LogFiltered instead of
LogWithoutRaw.
Jean Paul
-----Original Message-----
From: issforum-bounces@atla-mm1.iss.net On Behalf Of Mohr James
Sent: Tuesday, November 16, 2004 12:44 PM
To: issforum@atla-mm1.iss.net
Subject: [ISSForum] Reducing the number of events
Hi All!
My boss wants to significantly reduce the number of
events that are
sent from a number of sensors. I know you can disable specific
events, but is there anyway to say that you do not want any low
priority events at all. I know how to change the view in
the console
to not display low severity, but I my boss does not want them to
even get sent to the event collector. Is there any way to do this?
Regards,
Jim Mohr
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla->
mm1.iss.net/mailman/listinfo/issforum
To
contact the
ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by
Internet Security
Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-> mm1.iss.net/mailman/listinfo/issforum
To
contact the
ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet
Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
