Symantec 10268947 User Guide - Page 30

30 Architecture About management and detection architecture ■ Protection policy database: Stores the pre-defined protection policies that installed with the product and those added through LiveUpdate, as well as any user-defined signatures. ■ Response rule database: Stores the rules that define the actions to take when an attack is identified, the priority to give to the attack incidents, and the necessity for further investigation of the attack. ■ Configuration database: Stores configurable parameters that SuperUsers and Administrators can use to configure tasks at the node level and to configure detection at the sensor level. ■ Incident and event databases: Stores information about events and incidents. The event log can be signed periodically by the iButton or soft token to verify that the log has not been tampered with or altered in any way. The iButton is a hardware device that safeguards the signature certificate and confirms the identity of a Network Security software node. ■ LiveUpdate database: Stores data relevant for LiveUpdate. ■ User database: Stores information about each user login account. About Event Stream Provider The Event Stream Provider (ESP) prevents event flood invasions by intelligently processing them in multiple event queues, based on key criteria. In this way, if multiple identical events bombard the network, the ESP treats the flood of events as a single unit. This prevents any one event type or event source from overloading a security administrator. Thus, the events that are forwarded are representative of the actual activity on the network. If it is necessary to drop events for stability and security, the ESP does so in a manner that loses as little important information as possible. If a second attack is hidden beneath the volume of an event flood attack, the events related to the hidden attack will differ from the flood events. Therefore, the ESP places these events in separate queues. The analysis framework can then analyze the events related to the hidden attack. In this way, Symantec Network Security analyzes and responds to both attacks quickly and effectively. About sensor processes Symantec Network Security sensors can operate using in-line or passive mode, and using interface groups or single monitoring interfaces. In-line deployment and interface groups are possible using a Symantec Network Security 7100 Series appliance only. Independent of the deployment mode of a particular sensor, Symantec Network Security applies the same comprehensive detection strategy and protection,