Symantec 10268947 User Guide - Page 94

94 Incidents and Events About incidents and events About the Incidents tab The Network Security console displays incident and event data in the following: ■ Incidents tab: Displays both active and idle incidents. When you select an incident, Events At Selected Incident in the lower pane displays information about the related events. ■ Devices tab: Displays the topology tree. When you select an object in the topology tree, the Network Security console displays related information in the right pane, including a link to security incidents that are currently active on that object. The Incidents tab provides a multi-level view of both incidents and events. Incidents are groups of multiple related base events. Base events are the representation of individual occurrences, either suspicious or operational. The sensors notify the software or appliance node of any suspicious actions or occurrences that might warrant a response, such as a probe. Symantec Network Security also monitors operational occurrences that the user should be aware of, such as a Symantec Network Security license approaching the expiration date. The Incidents tab contains an upper and lower pane: Incidents, and Events at Selected Incident. The upper pane displays information about each incident, taken from the highest-priority event within that incident. The values may change if an event of higher priority is added to the same incident.