HP X Unified Security Platform Traffic Threshold Report, Quarantine Report, Configure Adaptive Filter Events Report

Reports

Traffic Threshold Report

In the LSM, traffic threshold filters track statistical changes in network traffic patterns. You can specify the amount of traffic that triggers a Traffic Threshold filter from the Traffic Threshold Reports page. The units used in the report (packets/hour, bytes/minute, connections/second, etc.) is determined by the units configured in the Traffic Threshold filter.

Note The Traffic Threshold report is only available if an IPS Traffic Threshold filter has been configured for the device.

Traffic data is reported based on the viewing options you select on the Traffic Threshold Reports page:

•Traffic Threshold filter name — in the dropdown list under the Traffic Thresholds table heading, select the filter name to generate the traffic data for that filter.

•Reporting time interval — click the time interval for the reporting period: Last 35 Days, Last 24 hours, Last 60 Minutes, Last 60 seconds.

For additional information, see the “Traffic Threshold Filters” on page 38.

Quarantine Report

In the LSM, you can configure a filter with a quarantine action set. When a host computer triggers the filter, the host is quarantined according to the settings configured in the action set. You can monitor quarantine activity from the Quarantine Reports page.

Quarantine data is reported based on the viewing options you select on the Quarantine Reports page:

•Total Hosts — displays the total number of quarantined hosts as a function of time.

•Packets Blocked — displays the total number of packets blocked as a function of time.

•Src Pages — displays the number of LSM quarantine pages served to quarantined hosts as a function of time. The quarantine source pages are generated based on the configuration specified in the Quarantine action set.

•Redirect Pages — displays the number of times hosts have been redirected as a result of a quarantine action as a function of time.

•Reporting time interval — click the time interval for the reporting period: Days (last 35), Hours (last 24), Minutes (last 60), Seconds (last 60).

Note More detailed information on quarantined hosts is available from the Quarantined Addresses page. For details, see “Quarantined Addresses” on page 113.

Configure Adaptive Filter Events Report

From the Configure Adaptive Filter Events Report page, you can:

•review and modify the global Adaptive Filter configuration

•view a list of the 10 most recent filters managed by adaptive filtering

•disable adaptive filter settings for an individual filter.

X Family LSM User’s Guide V 2.5.1 125