Symantec 10268947 User Guide - Page 81

About custom response action

Get Symantec 10268947 - Network Security 7160 PDF manuals and user guides
UPC - 037648243766
View all Symantec 10268947 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 81 highlights

Response Rules 81 About response actions About custom response action The Network Security console provides a way to set custom response actions to launch third-party applications in response to an incident. To do this, a command is entered in the Custom Response field which executes when the response rule is triggered. The minimum delay between responses is 0. Note: Both StandardUsers and RestrictedUsers can view custom response actions, but cannot write them. About TCP reset response action The TCP reset response action directs Symantec Network Security to terminate a TCP connection to prevent further damage from an attack. The minimum delay between responses is 0. About traffic record response action The traffic record response dynamically records network traffic in response to an event. With this option, Symantec Network Security can record traffic for a specified period of time, or until a specified number of packets has been collected. The traffic record response action begins recording traffic when triggered. It continues to record based on the number of minutes and the number of packets specified in the response configuration. Traffic recording stops when either limit is reached, whichever comes first. If the maximum number of packets is reached before the maximum time, then traffic record stops recording, but waits until the maximum time has expired before starting a new record action. The number of responses per incident is also determined by the response configuration. The minimum delay between responses is 1 minute. The traffic record response action begins recording traffic when triggered. It continues to record based on the number of minutes and the number of packets specified in the response configuration. Traffic recording stops when either limit is reached, whichever comes first. If the maximum number of packets is reached before the maximum time, then traffic record stops recording, but waits until the maximum time has expired before starting a new record action. The number of responses per incident is also determined by the response configuration. The minimum delay between responses is 1 minute.

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
81
Response Rules
About response actions
About custom response action
The Network Security console provides a way to set custom response actions to
launch third-party applications in response to an incident. To do this, a
command is entered in the Custom Response field which executes when the
response rule is triggered. The minimum delay between responses is 0.
Note:
Both StandardUsers and RestrictedUsers can view custom response
actions, but cannot write them.
About TCP reset response action
The TCP reset response action directs Symantec Network Security to terminate
a TCP connection to prevent further damage from an attack. The minimum
delay between responses is 0.
About traffic record response action
The traffic record response dynamically records network traffic in response to
an event. With this option, Symantec Network Security can record traffic for a
specified period of time, or until a specified number of packets has been
collected.
The traffic record response action begins recording traffic when triggered. It
continues to record based on the number of minutes and the number of packets
specified in the response configuration. Traffic recording stops when either
limit is reached, whichever comes first. If the maximum number of packets is
reached before the maximum time, then traffic record stops recording, but waits
until the maximum time has expired before starting a new record action. The
number of responses per incident is also determined by the response
configuration. The minimum delay between responses is 1 minute.
The traffic record response action begins recording traffic when triggered. It
continues to record based on the number of minutes and the number of packets
specified in the response configuration. Traffic recording stops when either
limit is reached, whichever comes first. If the maximum number of packets is
reached before the maximum time, then traffic record stops recording, but waits
until the maximum time has expired before starting a new record action. The
number of responses per incident is also determined by the response
configuration. The minimum delay between responses is 1 minute.