Symantec 10521146 Administration Guide - Page 205

Monitoring 205 Managing incident and event data See the following for further information: ■ See "About incident/event reports" on page 229. ■ See "Interpreting severity and confidence levels" on page 197. Selecting view filters The Network Security console provides a way to adjust the view by selecting filters to display only a relevant subset of the total incident or event tables. ■ See "Selecting incident filters" on page 205. ■ See "Selecting event filters" on page 206. Selecting incident filters You can filter the view of incident data to provide a shorter list to sift through, using the Incident Filter. For example, you can set the Incidents table to display only active incidents. You can choose between viewing the incidents detected by all software and appliance nodes, and viewing only those detected by a particular software or appliance node. By default, incidents from all nodes are displayed. Note: When you apply incident view filters, they apply only to the incidents, not to the events correlated to the incidents. For example, even if you select the Sensor Only filter, an operational event that is correlated to a sensor incident will still be displayed. To filter the view of incidents or events 1 In the Incidents tab, in the upper Incidents pane, click Filters. 2 Click Hide Closed Incidents to show only active incidents in the cluster. 3 In Incident Class, do one of the following: ■ Click Hide All Operational to show only those incidents classified as sensor events, and filter out all operational notice events. ■ Click Hide Sensor to show only operational events, such as Network Security console logins. ■ Click Show All Operational and Sensor to show both operational and sensor events. 4 In Marked State, do one of the following: ■ Click Hide Unmarked to show only the incidents that have been marked in the Network Security console.