Content Security Gateway User’s Manual

„Enable Anomaly Flow IP Blocking: Select this option to enable the Anomaly Flow IP blocking function. Once the Anomaly Flow IP attacked is detected, it will block the connection for user-drefined blocking time.

„Enable E-mail Alert Notification: When Anomaly Flow IP attacked is detected, send alert e-mail to administrator by using e-mail address defined on System -> Setting.

„Enable NetBIOS Alert Notification: When Anomaly Flow IP attacked is detected, send alart message to administrator by using “Net send” command.

After enabling the needed options, click OK to activate the changes.

4.8 Monitor

CS-500 provides varied of information that can be used to check the status.

4.8.1 Log

The Content Security Gateway supports traffic logging and event logging to monitor and record services, connection times, and the source and destination network address. The Administrator may also download the log files for backup purposes. The Administrator mainly uses the Log menu to monitor the traffic passing through the Content Security Gateway.

What is Log?

Log records all connections that pass through the Content Security Gateway’s control policies. Traffic log’s parameters are setup when setting up control policies. Traffic logs record the details of packets such as the start and stop time of connection, the duration of connection, the source address, the destination address and services requested, for each control policy. Event logs record the contents of System Configuration changes made by the Administrator such as the time of change, settings that change, the IP address used to log on, etc.

How to use the Log

The Administrator can use the log data to monitor and manage the device and the networks. The Administrator can view the logged data to evaluate and troubleshoot the network, such as pinpointing the source of traffic congestions.

4.8.1.1 Traffic

The Administrator queries the Content Security Gateway for information, such as source address, destination address, start time, and Protocol port of all connections.

Entering the Traffic Log window

Step 1. Click the Traffic option under Log menu to enter the Traffic Log window.

- 193 -