[ISSForum] Correlation with Fusion Module

Hi All,

I have the Fusion module installed on a server that also hosts the RSSP 
database. The SP console, EC, application server and server controller are 
installed on another server.

I'm using System Scanner on a dedicated server to perform the VA scans.
I have entered all of my Server Sensor IPs in the Fusion policy and
configured it to perform correlation using the "most recent scan results"
and the ignore vulnerability information is set to 90 days.
When running the VA scans I used all of the initial policies and a few of
my customized policies. All of my servers have been scanned at least once
in the past 90 days, some 2-3 times.

Is it normal to see only 6% of correlation in the Event Analysis view?
Most of the status is; Unknown impact (no correlation)
The "Load Analysis View "is set at; Event Analysis - Event Name

I was expecting to see a lot more correlation than this.

Any comments regarding this subject would be appreciated,
Thank you,
Jean

Jean Levert
Corporate Security - Security Operations
Sûreté de l'entreprise - Opérations
Tel: (613)-244-6179
jean.levert@bell.ca
Pager: (613)-783-5298



_______________________________________________
ISSForum mailing list
ISSForum@iss.net

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to 
https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@iss.net

The ISSForum mailing list is hosted and managed by Internet Security Systems, 
6303 Barfield Road, Atlanta, Georgia, USA 30328.