McAfee® Host Intrusion Prevention 6.1 Product Guide | IPS Policies |
| IPS Events |
4
Marking similar events
With the large number of IPS events that can appear, you should limit the number of events displayed or how they appear. You can do this by marking particular events as read, unread, or hidden one by one; however, this can be a cumbersome process.
The Mark Similar Event as Read / Unread / Hidden option allows you to mark in one operation all existing similar events that match a set of criteria. New events triggered after performing this operation, however, are not automatically marked.
The matching criteria you establish are based on the attributes associated with events, and include any or all of the following:
Agent
Signatures
User
Process
Severity Level
To mark similar events:
1Select an event and click Mark Similar Events on the shortcut menu or Mark Similar Events on the toolbar.
The Mark Similar Events dialog box appears.
Figure 4-17 Mark Similar Events dialog box
2In the Mark events as list, select one of three states for the events: Unread, Read, or
Hidden.
3Select the checkbox next to each attribute you want to use as criteria for marking the events.
The parameter value next to the checkbox is automatically selected. To select another parameter, click Select. In the Selection List dialog box that appears, select the parameter and click OK.
60
