Symantec 10521146 Administration Guide - Page 334

334 SQL reference Using MySQL tables Table B-3 MySQL Incident Table Field Name Type Description Notes severity state time type viewed integer integer integer varchar(129) integer Indicates the severity of the best event. Valid values are 1-10 Indicates the state of this incident. 1 = active (currently being monitored by the AF) 0 = closed (archived to the db) Indicates the time that the incident record was Standard UNIX time format last updated. (seconds since 1970 GMT) Indicates the type of the best event. Indicates the marked status of this incident. 0 = Not yet marked by a Network Security console user. 1 = Marked by a Network Security console user, and unchanged since. 2 = Marked by a Network Security console user, but has changed since. MySQL event table The following table describes the structure of the table that Symantec Network Security uses to export event data to a MySQL database: Table B-4 MySQL Event Table Field Name atkaction atkproc atkuser class Type integer text varchar(255) varchar(33) Description Notes Indicates the attempted action. Indicates the process name of the attacker, or blank if not applicable. Indicates the username of the attacker, or blank if not applicable. Indicates the event class. sniffer - for security events generic - for operational events, etc.