Symantec 10521146 Administration Guide - Page 147

Responding 147 Setting response actions 4 In the lower right pane, enter the community string. 5 Click Apply. 6 In Apply Changes To, select the node to which to apply the parameter. 7 Click OK to save the changes to this node and close. Setting TrackBack response action Symantec Network Security provides the TrackBack™ response to track attacks back to their sources. This capability is especially important for tracking denial-of-service attacks that must be traced to their source in order to shut them down most effectively. TrackBack automatically tracks a data stream to its source within the cluster, or, if the source is outside the cluster, to its entry point into the cluster. It does this by gathering information from routers or its own sensor resources. Sensor require interfaces with applied protection policies to run, as well as sensor parameters for flow statistics. Setting TrackBack response actions Symantec Network Security can begin tracking in response to an attack. The minimum delay between responses is 1 minute. To enable TrackBack 1 In the Network Security console, click Configuration > Response Rules. 2 In Response Rules, click the Response Action column of a rule. 3 In Configure Response Action, click TrackBack. 4 Provide the following information: ■ Maximum number of trackbacks: Enter the number of tracking attempts that you want. ■ Delay between trackbacks (mins): Enter the time in minutes that you want Symantec Network Security to wait before making another tracking attempt. 5 In Configure Response Action, click OK to save and exit. 6 In Response Rules, click OK to save and exit. Setting a custom response action The Network Security console provides a way to set custom response actions to launch third-party applications in response to an incident. To do this, a