Symantec 10268947 User Guide - Page 71

Protection Policies 71 Adjusting the view of event types automatically adds them to the policy. Even if the LiveUpdate occurs in the middle of the night, Symantec Network Security immediately starts logging the matching events. To view LiveUpdate 1 In the Policies tab, click Protection Policies > View > Auto Update Rules. 2 Click Cancel to close the view. Note: Both StandardUsers and RestrictedUsers can view Auto Update rules, but cannot add, edit, or delete them. Annotating policies or events You can take notes on events at the following three levels: ■ Viewing policy annotations ■ Viewing event type annotations ■ Annotating event instances Viewing policy annotations If notes were taken about a particular policy, then when you hover the cursor over that policy in the policy list, the note appears as a tool tip. To view a policy annotation ◆ In the Policies tab, hover the cursor over the policy to display the note as a tool tip. Note: Both StandardUsers and RestrictedUsers can view tool tips to protection policies, but cannot add, edit, or delete them. Viewing event type annotations The Network Security console provides a field in which to make notes about an event type within a policy. When the event is triggered, the note is displayed in the Event Details. For example, a note might indicate that this event is a false positive if it occurs within a certain IP range. The note is specific to that event type when it occurs in that policy. The Event Details pane displays the note each time this policy detects the annotated event.