Symantec 10268947 User Guide - Page 74

About automated responses

Get Symantec 10268947 - Network Security 7160 PDF manuals and user guides
UPC - 037648243766
View all Symantec 10268947 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 74 highlights

74 Response Rules About automated responses functionality that is unique to an appliance. Each section describes this additional functionality in detail. Symantec Network Security can take the following types of actions to respond to attacks, individually or in sequence: ■ Predefined actions See "About response actions" on page 79. ■ Configured custom response actions See "About custom response action" on page 81. ■ Triggered actions from third-party applications via Smart Agents See "Integrating third-party events" on page 282. ■ No actions See "About no response action" on page 80. ■ Responding at the point of entry See "Defining new protection policies" on page 120. About automated responses Symantec Network Security's automated rule-based response system includes alerting, pinpoint traffic recording, flow tracing, session resetting, and custom responses on both the software and appliance nodes and the Network Security console. Symantec Network Security generates responses based on multiple criteria such as event targets, attack types or categories, event sources, and severity or confidence levels. Multiple responses can be configured for the same event type, as well as the order in which Symantec Network Security executes the responses. Symantec Network Security reviews each event, and iterates through the list of response rules configured by the user. It compares each event against configurable match parameters. If a match occurs on all parameters, it then executes the specified action. After Symantec Network Security processes one rule, it proceeds to one of three alternatives: to the rule indicated by the Next parameter, to a following rule beyond the Next rule, or it stops policy application altogether for this event. Some automated responses also use node parameters through Configuration > Node > Network Security Parameters. Symantec Network Security installs with some of the response rule parameters defaulted; however, they require more information to run successfully.

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
74
Response Rules
About automated responses
functionality that is unique to an appliance. Each section describes this
additional functionality in detail.
Symantec Network Security can take the following types of actions to respond to
attacks, individually or in sequence:
■
Predefined actions
See
“About response actions”
on page 79.
■
Configured custom response actions
See
“About custom response action”
on page 81.
■
Triggered actions from third-party applications via Smart Agents
See
“Integrating third-party events”
on page 282.
■
No actions
See
“About no response action”
on page 80.
■
Responding at the point of entry
See
“Defining new protection policies”
on page 120.
About automated responses
Symantec Network Security’s automated rule-based response system includes
alerting, pinpoint traffic recording, flow tracing, session resetting, and custom
responses on both the software and appliance nodes and the Network Security
console. Symantec Network Security generates responses based on multiple
criteria such as event targets, attack types or categories, event sources, and
severity or confidence levels. Multiple responses can be configured for the same
event type, as well as the order in which Symantec Network Security executes
the responses.
Symantec Network Security reviews each event, and iterates through the list of
response rules configured by the user. It compares each event against
configurable match parameters. If a match occurs on all parameters, it then
executes the specified action. After Symantec Network Security processes one
rule, it proceeds to one of three alternatives: to the rule indicated by the Next
parameter, to a following rule beyond the Next rule, or it stops policy
application altogether for this event.
Some automated responses also use node parameters through Configuration >
Node > Network Security Parameters. Symantec Network Security installs with
some of the response rule parameters defaulted; however, they require more
information to run successfully.