Symantec 10521146 Administration Guide - Page 195

Monitoring 195 Examining incident and event data ■ Annotating incident data ■ Viewing an incident's top event ■ Saving incident data ■ Copying and pasting incidents ■ Emailing incident data ■ Printing incident data Viewing an incident's top event The Network Security console provides a way to see the highest priority event that is correlated to any incident, called the top event. Note: SuperUsers and Administrators can drill down to view an incident's top event. See "User groups reference" on page 319 for more about permissions. To view the top event 1 In the Incidents tab, in the upper Incidents pane, right-click an incident. 2 Click View Incident Details from the pop-up list. 3 In Incident Details, click Top Event to view the highest priority event correlated to that incident. Event Details of the top event can display any or all of the following information: ■ Event name ■ Severity level ■ Confidence level ■ Start time Indicates the name of the event. Indicates the severity level assigned to the incident. An incident's severity is a measure of the potential damage that an incident can cause. Indicates the confidence level assigned to the incident. The confidence value indicates the level of certainty that a particular incident is actually an attack. If the incident is merely suspicious, then its assigned confidence level is low. If Symantec Network Security collects more data on the incident to substantiate its confidence, the confidence is adjusted upward. Indicates the time at which Symantec Network Security started monitoring the event.