Filter
Top Products
60
McAfee
®
Host Intrusion Prevention 6.1 Product Guide IPS Policies
IPS Events
4
Marking similar events
With the large number of IPS events that can appear, you should limit the number of
events displayed or how they appear. You can do this by marking particular events as
read, unread, or hidden one by one; however, this can be a cumbersome process.
The
Mark Similar Event as Read / Unread / Hidden option allows you to mark in one operation
all existing similar events that match a set of criteria. New events triggered after
performing this operation, however, are not automatically marked.
The matching criteria you establish are based on the attributes associated with events,
and include any or all of the following:
Agent
Signatures
User
Process
Severity Level
To mark similar events:
1 Select an event and click
Mark Similar Events on the shortcut menu or Mark Similar Events
on the toolbar.
The
Mark Similar Events dialog box appears.
2 In the
Mark events as list, select one of three states for the events: Unread, Read, or
Hidden.
3 Select the checkbox next to each attribute you want to use as criteria for marking
the events.
The parameter value next to the checkbox is automatically selected. To select
another parameter, click
Select. In the Selection List dialog box that appears, select the
parameter and click
OK.
Figure 4-17 Mark Similar Events dialog box