Help Center Monitor Alerts and Alarms - Overview

Contents

Contents

Security Director User Guide
- About the Documentation
- Junos Space Security Director
  - Overview
    - Junos Space Security Director Overview
- Dashboard
  - Overview
    - Dashboard Overview
- Monitor
  - Events and Logs-All Events
    - Events and Logs Overview
    - Creating Alerts
    - Creating Reports
    - Creating Filters
    - Grouping Events
    - Using Events and Logs Settings
    - Selecting Events and Logs Table Columns
    - Viewing Threats
    - Using the Detailed Log View
    - Using the Raw Log View
    - Showing Exact Match
    - Using Filter on Cell Data
    - Using Exclude Cell Data
    - Showing Firewall Policy
    - Showing Source NAT Policy
    - Showing Destination NAT Policy
    - Using Filters
  - Events and Logs-Firewall
    - Firewall Events and Logs Overview
  - Events and Logs-Web Filtering
    - Web Filtering Events and Log Overview
  - Events and Logs-VPN
    - VPN Events and Logs Overview
  - Events and Logs-Content Filtering
    - Content Filtering Events and Logs Overview
  - Events and Logs-Antispam
    - Antispam Events and Logs Overview
  - Events and Logs-Antivirus
    - Antivirus Events and Logs Overview
  - Events and Logs-IPS
    - IPS Events and Logs Overview
  - Threat Prevention-Infected Hosts
    - Infected Hosts Overview
    - Infected Host Details
  - Threat Prevention-C&C Servers
    - Command and Control Servers Overview
    - Command and Control Server Details
  - Threat Prevention-Malware
    - HTTP File Scanning Overview
    - HTTP File Scanning Details
    - Email Attachments Scanning Overview
    - Email Attachments Scanning Details
    - SMTP Quarantine Overview
  - Threat Prevention-Manual Upload
    - Manual Scanning Overview
    - File Scanning Limits
  - Applications
    - Application Visibility Overview
    - Blocking Applications and Users
  - Users
    - User Visibility Overview
    - Blocking Users and Applications
  - Source IP
    - Source IP Visibility Overview
    - Blocking Source IP Addresses
  - Live Threat Map
    - Threat Map Overview
    - Blocking Threat Events
  - Alerts and Alarms - Overview
    - Alerts and Alarms Overview
  - Alerts and Alarms-Alerts
    - Deleting an Alert
    - Searching Alerts
    - Using Generated Alerts
  - Alerts and Alarms-Alert Definitions
    - Creating Alert Definitions
    - Editing Alert Definitions
    - Cloning Alert Definition
    - Deleting Alert Definitions
    - Searching Alert Definitions
    - Alert Definitions Main Page Fields
  - Alerts and Alarms-Alarms
    - Using Device Alarms
    - Device Alarms Main Page Fields
  - Job Management
    - Using Job Management in Security Director
    - Overview of Jobs in Security Director
    - Archiving and Purging Jobs in Security Director
    - Viewing the Details of a Job in Security Director
    - Canceling Jobs in Security Director
    - Reassigning Jobs in Security Director
    - Rescheduling and Modifying the Recurrence of Jobs in Security Director
    - Retrying a Failed Job on Devices in Security Director
    - Exporting the Details of a Job in Security Director
    - Job Management Main Page Fields
  - Audit Logs
    - Using Audit Logs in Security Director
    - Understanding Audit Logs in Security Director
    - Purging or Archiving and Purging Audit Logs in Security Director
    - Exporting Audit Logs in Security Director
    - Viewing the Details of an Audit Log in Security Director
    - Audit Logs Main Page Fields
- Devices
- Configure
  - Firewall Policy-Policies
    - Firewall Policies Overview
    - Policy Ordering Overview
    - Creating Firewall Policies
    - Firewall Policies Best Practices
    - Creating Firewall Policy Rules
    - Rule Base Overview
    - Rule Operations on Filtered Rules Overview
    - Creating and Managing Policy Versions
    - Comparing Policies
    - Exporting Policies
    - Creating Custom Columns
    - Importing Policies
    - Deleting and Replacing Policies and Objects
    - Editing and Cloning Policies and Objects
    - Publishing Policies
    - Showing Duplicate Policies and Objects
    - Showing and Deleting Unused Policies and Objects
    - Updating Policies on Devices
    - Firewall Policies Main Page Fields
    - Firewall Policy Rules Main Page Fields
  - Firewall Policy-Devices
    - Assigning Devices to Policies
    - Devices with Firewall Policies Main Page Fields
  - Firewall Policy-Schedules
    - Schedules Overview
    - Creating Schedules
    - Schedules Main Page Fields
  - Firewall Policy-Profiles
    - Understanding Firewall Policy Profiles
    - Creating Firewall Policy Profiles
    - Editing and Cloning Policies and Objects
    - Deleting and Replacing Policies and Objects
    - Assigning Policies and Profiles to Domains
    - Viewing Policy and Shared Object Details
    - Firewall Policy Profiles Main Page Fields
  - Firewall Policy-Templates
    - Understanding Firewall Policy Templates
    - Creating Firewall Policy Templates
    - Editing and Cloning Policies and Objects
    - Deleting and Replacing Policies and Objects
    - Firewall Policy Templates Main Page Fields
  - Application Firewall Policy-Policies
    - Understanding Application Firewall Policies
    - Creating Application Firewall Policies
    - Deleting and Replacing Policies and Objects
    - Editing and Cloning Policies and Objects
    - Showing and Deleting Unused Policies and Objects
    - Finding Usages for Policies and Objects
    - Application Firewall Policies Main Page Fields
  - Application Firewall Policy-Signatures
    - Creating Application Signature Groups
    - Application Signatures Main Page Fields
  - Application Firewall Policy-SSL Forward Proxy Profiles
    - SSL Forward Proxy Overview
    - Creating SSL Forward Proxy Profiles
    - SSL Forward Proxy Profile Main Page Fields
  - User Firewall Management-Active Directory
    - About the Active Directory Profile Page
    - Creating Active Directory Profiles
    - Deploying the Active Directory Profile to SRX Series Devices
    - Editing and Deleting Active Directory Profiles
      - Editing Active Directory Profiles
      - Deleting Active Directory Profiles
  - User Firewall Management-Access Profile
    - LDAP Functionality in Integrated User Firewall Overview
    - About the Access Profile Page
    - Creating Access Profiles
    - Deploying the Access Profile to SRX Series Devices
    - Editing and Deleting Access Profiles
      - Editing Access Profiles
      - Deleting Access Profiles
  - IPS Policy-Policies
    - Understanding IPS Policies
    - Creating IPS Policies
    - Creating IPS Policy Rules
    - Publishing Policies
    - Updating Policies on Devices
    - Assigning Devices to Policies
    - Creating and Managing Policy Versions
    - Creating Rule Name Template
    - Exporting Policies
    - Unassigning Devices to Policies
    - Editing and Cloning Policies and Objects
    - Deleting and Replacing Policies and Objects
    - Assigning Policies and Profiles to Domains
    - Viewing Policy and Shared Object Details
    - IPS Policies Main Page Fields
  - IPS Policy-Devices
    - Understanding IPS Policies
    - Devices with IPS Policies Main Page Fields
  - IPS Policy-Signatures
    - Understanding IPS Signatures
    - Creating IPS Signatures
    - Creating IPS Signature Static Groups
    - Creating IPS Signature Dynamic Groups
    - Editing and Cloning Policies and Objects
    - Deleting and Replacing Policies and Objects
    - Viewing Policy and Shared Object Details
    - IPS Policy Signatures Main Page Fields
  - IPS Policy-Templates
    - Understanding IPS Policy Templates
    - Creating IPS Policy Templates
    - Editing and Cloning Policies and Objects
    - Deleting and Replacing Policies and Objects
    - IPS Policy Templates Main Page Fields
  - NAT Policy-Policies
    - NAT Overview
    - NAT Global Address Book Overview
    - Creating NAT Policies
    - Publishing Policies
    - NAT Policy Rules Main Page Field
    - Creating NAT Rules
    - Updating Policies on Devices
    - Editing and Cloning Policies and Objects
    - Deleting and Replacing Policies and Objects
    - Viewing Policy and Shared Object Details
    - Assigning Policies and Profiles to Domains
    - Comparing Policies
    - Creating and Managing Policy Versions
    - Assigning Devices to Policies
    - Unassigning Devices to Policies
    - Creating Rule Name Template
    - Configuring NAT Rule Sets
    - NAT Policies Main Page Fields
  - NAT Policy-Devices
    - Devices with NAT Policies Main Page Fields
  - NAT Policy-Pools
    - Creating NAT Pools
    - Editing and Cloning Policies and Objects
    - Deleting and Replacing Policies and Objects
    - Showing and Deleting Unused Policies and Objects
    - Showing Duplicate Policies and Objects
    - Viewing Policy and Shared Object Details
    - Assigning Policies and Profiles to Domains
    - NAT Pools Main Page Fields
  - NAT Policy-Port Sets
    - Creating Port Sets
    - Deleting and Replacing Policies and Objects
    - Editing and Cloning Policies and Objects
    - Showing and Deleting Unused Policies and Objects
    - Showing Duplicate Policies and Objects
    - Viewing Policy and Shared Object Details
    - Assigning Policies and Profiles to Domains
    - Port Sets Main Page Fields
  - UTM Policy-Policies
    - UTM Overview
    - Creating UTM Policies
    - Comparing Policies
    - Deleting and Replacing Policies and Objects
    - Viewing Policy and Shared Object Details
    - Assigning Policies and Profiles to Domains
    - Showing Duplicate Policies and Objects
    - Editing and Cloning Policies and Objects
    - Showing and Deleting Unused Policies and Objects
    - UTM Policies Main Page Fields
  - UTM Policy-Web Filtering Profiles
    - Creating Web Filtering Profiles
    - Selecting a Web Filtering Solution
    - Web Filtering Profile Main Page Fields
  - UTM Policy-Antivirus Profiles
    - Creating Antivirus Profiles
    - Antivirus Profile Main Page Fields
  - UTM Policy-Antispam Profiles
    - Creating Antispam Profiles
    - Antispam Profile Main Page Fields
  - UTM Policy-Content Filtering Profiles
    - Creating Content Filtering Profiles
    - Content Filtering Profile Main Page Fields
  - UTM Policy-Global Device Profiles
    - Creating Device Profiles
    - Device Profiles Main Page Fields
  - UTM Policy-URL Patterns
    - Creating URL Patterns
  - UTM Policy-Custom URL Categories
    - Creating Custom URL Category Lists
  - Threat Prevention - Policies
    - Creating Threat Prevention Policies
    - Threat Prevention Policy Overview
    - Threat Policy Analysis Overview
  - Threat Prevention - Sky ATP Realms
    - Creating Sky ATP Realms and Enrolling Devices or Associating Sites
    - Sky ATP Realm Overview
  - Threat Prevention - Custom Feeds
    - Creating Custom Feeds
  - IPsec VPN-VPNs
    - IPsec VPN Overview
    - Creating IPsec VPNs
    - Understanding IPsec VPN Modes
    - Comparison of Policy-Based VPNs and Route-Based VPNs
    - Understanding IPsec VPN Routing
    - Understanding IKE Authentication
    - Publishing IPsec VPNs
    - Updating IPSec VPN
    - Modifying VPN Settings
    - Viewing Tunnels
    - Importing IPsec VPNs
    - IPsec VPN Main Page Fields
  - IPsec VPN-Extranet Devices
    - Creating Extranet Devices
    - Extranet Devices Main Page Fields
  - IPsec VPN-Profiles
    - VPN Profiles Overview
    - Creating VPN Profiles
    - Editing and Cloning Policies and Objects
    - Assigning Policies and Profiles to Domains
    - VPN Profiles Main Page Fields
  - Shared Objects-Geo IP
    - Creating Geo IP Policies
    - Geo IP Overview
    - Deleting and Replacing Policies and Objects
  - Shared Objects-Policy Enforcement Groups
    - Creating Policy Enforcement Groups
    - Policy Enforcement Groups Overview
    - Deleting and Replacing Policies and Objects
  - Shared Objects-Addresses
    - Addresses and Address Groups Overview
    - Creating Addresses and Address Groups
    - Importing and Exporting CSV Files
    - Assigning Addresses and Address Groups to Domains
    - Showing Duplicate Policies and Objects
    - Addresses Main Page Fields
  - Shared Objects-Services
    - Services and Service Groups Overview
    - Creating Services and Service Groups
    - Importing and Exporting CSV Files
    - Showing Duplicate Policies and Objects
  - Shared Objects-Variables
    - Variables Overview
    - Creating Variables
    - Editing Variables
    - Importing and Exporting CSV Files
    - Showing Duplicate Policies and Objects
  - Shared Objects-Zone Sets
    - Understanding Zone Sets
    - Creating Zone Sets
    - Editing and Cloning Policies and Objects
    - Deleting and Replacing Policies and Objects
    - Finding Usages for Policies and Objects
    - Showing and Deleting Unused Policies and Objects
    - Showing Duplicate Policies and Objects
    - Viewing Policy and Shared Object Details
    - Zone Sets Main Page Fields
  - Sky ATP with Policy Enforcer Overview
    - Policy Enforcer Overview
    - Benefits of Policy Enforcer
    - Policy Enforcer Components
    - Sky ATP Features
    - Comparing the SDSN and non-SDSN Configuration Steps
  - Installing Policy Enforcer
    - Policy Enforcer Installation Overview
    - Deploying and Configuring the Policy Enforcer Virtual Machine
    - Identifying the Policy Enforcer Virtual Machine In Security Director
    - Obtaining a Sky ATP License
    - Creating a Sky ATP Cloud Web Portal Login Account
    - Loading a Root CA
  - Configuring Policy Enforcer Settings (Required Sky ATP, Policy Enforcer, and Cloud Feeds)
    - Policy Enforcer Settings
  - Guided Setup-Sky ATP with Policy Enforcer
    - Using Quick Setup for Sky ATP with Policy Enforcer
  - Guided Setup-Sky ATP
    - Using Quick Setup for Sky ATP
  - Manual Configuration-Sky ATP with Policy Enforcer
    - Configuring Sky ATP with PE (Without Quick Setup) Overview
    - Creating Sky ATP Realms and Enrolling Devices or Associating Sites
    - Secure Fabric Overview
    - Creating Secure Fabric and Sites
    - Editing or Deleting a Secure Fabric
    - Policy Enforcement Groups Overview
    - Creating Policy Enforcement Groups
    - Threat Prevention Policy Overview
    - Creating Threat Prevention Policies
    - Threat Policy Analysis Overview
    - Geo IP Overview
    - Creating Geo IP Policies
  - Manual Configuration-Sky ATP
    - Configuring Sky ATP (No PE and No Quick Setup) Overview
    - Sky ATP Realm Overview
    - Creating Sky ATP Realms and Enrolling Devices or Associating Sites
    - Threat Prevention Policy Overview
    - Creating Threat Prevention Policies
  - Configuring Cloud Feeds Only
    - Configuring Cloud Feeds Only
- Reports
  - Reports
- Administration
  - My Profile
    - Modifying Your User Profile in Security Director
  - Users and Roles-Users
    - Overview of Users in Security Director
    - Creating Users in Security Director
    - Editing and Deleting Users in Security Director
      - Editing Users
      - Deleting Users
    - Viewing and Terminating Active User Sessions in Security Director
      - Viewing Active User Sessions
      - Terminating Active User Sessions
    - Viewing the User Details in Security Director
    - Clearing Local Passwords for Users in Security Director
    - Disabling and Enabling Users in Security Director
      - Disabling Users
      - Enabling Users
    - Unlocking Users in Security Director
    - Users Main Page Fields
  - Users and Roles-Roles
    - Domain RBAC Overview
    - Creating Customized Roles in Security Director
    - Understanding Roles in Security Director
    - Editing, Cloning, and Deleting Roles in Security Director
    - Viewing the Details of a Role in Security Director
    - Importing and Exporting Roles in Security Director
      - Importing Roles
      - Exporting Roles
    - Roles Main Page Fields
  - Users and Roles-Domains
    - Overview of Domains in Security Director
    - Creating Domains in Security Director
    - Editing and Deleting Domains in Security Director
    - Exporting Domains in Security Director
    - Viewing Users, Devices, and Remote Profiles Assigned to a Domain in Security Director
    - Assigning Devices to Domains in Security Director
    - Assigning and Unassigning Remote Profiles to Domains in Security Director
      - Assigning Remote Profiles to Domains
      - Unassigning Remote Profiles from Domains
    - Assigning and Unassigning Users to Domains in Security Director
      - Assigning Users to Domains
      - Unassigning Users from Domains
    - Domains Main Page Fields
  - Users and Roles-Remote Profiles
  - Logging Management
  - Logging Management-Logging Nodes
  - Logging Management-Statistics & Troubleshooting
    - Using the Log Statistics and Troubleshooting
  - Logging Management-Logging Devices
    - Logging Devices Main Page Fields
    - Creating Security Logs
  - Monitor Settings
    - About the Monitor Settings Page
    - Monitor Settings Overview
  - Signature Database
  - Migrating Content from NSM to Security Director
    - NSM Migration
  - Monitoring and Troubleshooting with Security Director Log Collector

Contents

Security Director User Guide
- About the Documentation
- Junos Space Security Director
  - Overview
    - Junos Space Security Director Overview
- Dashboard
  - Overview
    - Dashboard Overview
- Monitor
  - Events and Logs-All Events
    - Events and Logs Overview
    - Creating Alerts
    - Creating Reports
    - Creating Filters
    - Grouping Events
    - Using Events and Logs Settings
    - Selecting Events and Logs Table Columns
    - Viewing Threats
    - Using the Detailed Log View
    - Using the Raw Log View
    - Showing Exact Match
    - Using Filter on Cell Data
    - Using Exclude Cell Data
    - Showing Firewall Policy
    - Showing Source NAT Policy
    - Showing Destination NAT Policy
    - Using Filters
  - Events and Logs-Firewall
    - Firewall Events and Logs Overview
  - Events and Logs-Web Filtering
    - Web Filtering Events and Log Overview
  - Events and Logs-VPN
    - VPN Events and Logs Overview
  - Events and Logs-Content Filtering
    - Content Filtering Events and Logs Overview
  - Events and Logs-Antispam
    - Antispam Events and Logs Overview
  - Events and Logs-Antivirus
    - Antivirus Events and Logs Overview
  - Events and Logs-IPS
    - IPS Events and Logs Overview
  - Threat Prevention-Infected Hosts
    - Infected Hosts Overview
    - Infected Host Details
  - Threat Prevention-C&C Servers
    - Command and Control Servers Overview
    - Command and Control Server Details
  - Threat Prevention-Malware
    - HTTP File Scanning Overview
    - HTTP File Scanning Details
    - Email Attachments Scanning Overview
    - Email Attachments Scanning Details
    - SMTP Quarantine Overview
  - Threat Prevention-Manual Upload
    - Manual Scanning Overview
    - File Scanning Limits
  - Applications
    - Application Visibility Overview
    - Blocking Applications and Users
  - Users
    - User Visibility Overview
    - Blocking Users and Applications
  - Source IP
    - Source IP Visibility Overview
    - Blocking Source IP Addresses
  - Live Threat Map
    - Threat Map Overview
    - Blocking Threat Events
  - Alerts and Alarms - Overview
    - Alerts and Alarms Overview
  - Alerts and Alarms-Alerts
    - Deleting an Alert
    - Searching Alerts
    - Using Generated Alerts
  - Alerts and Alarms-Alert Definitions
    - Creating Alert Definitions
    - Editing Alert Definitions
    - Cloning Alert Definition
    - Deleting Alert Definitions
    - Searching Alert Definitions
    - Alert Definitions Main Page Fields
  - Alerts and Alarms-Alarms
    - Using Device Alarms
    - Device Alarms Main Page Fields
  - Job Management
    - Using Job Management in Security Director
    - Overview of Jobs in Security Director
    - Archiving and Purging Jobs in Security Director
    - Viewing the Details of a Job in Security Director
    - Canceling Jobs in Security Director
    - Reassigning Jobs in Security Director
    - Rescheduling and Modifying the Recurrence of Jobs in Security Director
    - Retrying a Failed Job on Devices in Security Director
    - Exporting the Details of a Job in Security Director
    - Job Management Main Page Fields
  - Audit Logs
    - Using Audit Logs in Security Director
    - Understanding Audit Logs in Security Director
    - Purging or Archiving and Purging Audit Logs in Security Director
    - Exporting Audit Logs in Security Director
    - Viewing the Details of an Audit Log in Security Director
    - Audit Logs Main Page Fields
- Devices
- Configure
  - Firewall Policy-Policies
    - Firewall Policies Overview
    - Policy Ordering Overview
    - Creating Firewall Policies
    - Firewall Policies Best Practices
    - Creating Firewall Policy Rules
    - Rule Base Overview
    - Rule Operations on Filtered Rules Overview
    - Creating and Managing Policy Versions
    - Comparing Policies
    - Exporting Policies
    - Creating Custom Columns
    - Importing Policies
    - Deleting and Replacing Policies and Objects
    - Editing and Cloning Policies and Objects
    - Publishing Policies
    - Showing Duplicate Policies and Objects
    - Showing and Deleting Unused Policies and Objects
    - Updating Policies on Devices
    - Firewall Policies Main Page Fields
    - Firewall Policy Rules Main Page Fields
  - Firewall Policy-Devices
    - Assigning Devices to Policies
    - Devices with Firewall Policies Main Page Fields
  - Firewall Policy-Schedules
    - Schedules Overview
    - Creating Schedules
    - Schedules Main Page Fields
  - Firewall Policy-Profiles
    - Understanding Firewall Policy Profiles
    - Creating Firewall Policy Profiles
    - Editing and Cloning Policies and Objects
    - Deleting and Replacing Policies and Objects
    - Assigning Policies and Profiles to Domains
    - Viewing Policy and Shared Object Details
    - Firewall Policy Profiles Main Page Fields
  - Firewall Policy-Templates
    - Understanding Firewall Policy Templates
    - Creating Firewall Policy Templates
    - Editing and Cloning Policies and Objects
    - Deleting and Replacing Policies and Objects
    - Firewall Policy Templates Main Page Fields
  - Application Firewall Policy-Policies
    - Understanding Application Firewall Policies
    - Creating Application Firewall Policies
    - Deleting and Replacing Policies and Objects
    - Editing and Cloning Policies and Objects
    - Showing and Deleting Unused Policies and Objects
    - Finding Usages for Policies and Objects
    - Application Firewall Policies Main Page Fields
  - Application Firewall Policy-Signatures
    - Creating Application Signature Groups
    - Application Signatures Main Page Fields
  - Application Firewall Policy-SSL Forward Proxy Profiles
    - SSL Forward Proxy Overview
    - Creating SSL Forward Proxy Profiles
    - SSL Forward Proxy Profile Main Page Fields
  - User Firewall Management-Active Directory
    - About the Active Directory Profile Page
    - Creating Active Directory Profiles
    - Deploying the Active Directory Profile to SRX Series Devices
    - Editing and Deleting Active Directory Profiles
      - Editing Active Directory Profiles
      - Deleting Active Directory Profiles
  - User Firewall Management-Access Profile
    - LDAP Functionality in Integrated User Firewall Overview
    - About the Access Profile Page
    - Creating Access Profiles
    - Deploying the Access Profile to SRX Series Devices
    - Editing and Deleting Access Profiles
      - Editing Access Profiles
      - Deleting Access Profiles
  - IPS Policy-Policies
    - Understanding IPS Policies
    - Creating IPS Policies
    - Creating IPS Policy Rules
    - Publishing Policies
    - Updating Policies on Devices
    - Assigning Devices to Policies
    - Creating and Managing Policy Versions
    - Creating Rule Name Template
    - Exporting Policies
    - Unassigning Devices to Policies
    - Editing and Cloning Policies and Objects
    - Deleting and Replacing Policies and Objects
    - Assigning Policies and Profiles to Domains
    - Viewing Policy and Shared Object Details
    - IPS Policies Main Page Fields
  - IPS Policy-Devices
    - Understanding IPS Policies
    - Devices with IPS Policies Main Page Fields
  - IPS Policy-Signatures
    - Understanding IPS Signatures
    - Creating IPS Signatures
    - Creating IPS Signature Static Groups
    - Creating IPS Signature Dynamic Groups
    - Editing and Cloning Policies and Objects
    - Deleting and Replacing Policies and Objects
    - Viewing Policy and Shared Object Details
    - IPS Policy Signatures Main Page Fields
  - IPS Policy-Templates
    - Understanding IPS Policy Templates
    - Creating IPS Policy Templates
    - Editing and Cloning Policies and Objects
    - Deleting and Replacing Policies and Objects
    - IPS Policy Templates Main Page Fields
  - NAT Policy-Policies
    - NAT Overview
    - NAT Global Address Book Overview
    - Creating NAT Policies
    - Publishing Policies
    - NAT Policy Rules Main Page Field
    - Creating NAT Rules
    - Updating Policies on Devices
    - Editing and Cloning Policies and Objects
    - Deleting and Replacing Policies and Objects
    - Viewing Policy and Shared Object Details
    - Assigning Policies and Profiles to Domains
    - Comparing Policies
    - Creating and Managing Policy Versions
    - Assigning Devices to Policies
    - Unassigning Devices to Policies
    - Creating Rule Name Template
    - Configuring NAT Rule Sets
    - NAT Policies Main Page Fields
  - NAT Policy-Devices
    - Devices with NAT Policies Main Page Fields
  - NAT Policy-Pools
    - Creating NAT Pools
    - Editing and Cloning Policies and Objects
    - Deleting and Replacing Policies and Objects
    - Showing and Deleting Unused Policies and Objects
    - Showing Duplicate Policies and Objects
    - Viewing Policy and Shared Object Details
    - Assigning Policies and Profiles to Domains
    - NAT Pools Main Page Fields
  - NAT Policy-Port Sets
    - Creating Port Sets
    - Deleting and Replacing Policies and Objects
    - Editing and Cloning Policies and Objects
    - Showing and Deleting Unused Policies and Objects
    - Showing Duplicate Policies and Objects
    - Viewing Policy and Shared Object Details
    - Assigning Policies and Profiles to Domains
    - Port Sets Main Page Fields
  - UTM Policy-Policies
    - UTM Overview
    - Creating UTM Policies
    - Comparing Policies
    - Deleting and Replacing Policies and Objects
    - Viewing Policy and Shared Object Details
    - Assigning Policies and Profiles to Domains
    - Showing Duplicate Policies and Objects
    - Editing and Cloning Policies and Objects
    - Showing and Deleting Unused Policies and Objects
    - UTM Policies Main Page Fields
  - UTM Policy-Web Filtering Profiles
    - Creating Web Filtering Profiles
    - Selecting a Web Filtering Solution
    - Web Filtering Profile Main Page Fields
  - UTM Policy-Antivirus Profiles
    - Creating Antivirus Profiles
    - Antivirus Profile Main Page Fields
  - UTM Policy-Antispam Profiles
    - Creating Antispam Profiles
    - Antispam Profile Main Page Fields
  - UTM Policy-Content Filtering Profiles
    - Creating Content Filtering Profiles
    - Content Filtering Profile Main Page Fields
  - UTM Policy-Global Device Profiles
    - Creating Device Profiles
    - Device Profiles Main Page Fields
  - UTM Policy-URL Patterns
    - Creating URL Patterns
  - UTM Policy-Custom URL Categories
    - Creating Custom URL Category Lists
  - Threat Prevention - Policies
    - Creating Threat Prevention Policies
    - Threat Prevention Policy Overview
    - Threat Policy Analysis Overview
  - Threat Prevention - Sky ATP Realms
    - Creating Sky ATP Realms and Enrolling Devices or Associating Sites
    - Sky ATP Realm Overview
  - Threat Prevention - Custom Feeds
    - Creating Custom Feeds
  - IPsec VPN-VPNs
    - IPsec VPN Overview
    - Creating IPsec VPNs
    - Understanding IPsec VPN Modes
    - Comparison of Policy-Based VPNs and Route-Based VPNs
    - Understanding IPsec VPN Routing
    - Understanding IKE Authentication
    - Publishing IPsec VPNs
    - Updating IPSec VPN
    - Modifying VPN Settings
    - Viewing Tunnels
    - Importing IPsec VPNs
    - IPsec VPN Main Page Fields
  - IPsec VPN-Extranet Devices
    - Creating Extranet Devices
    - Extranet Devices Main Page Fields
  - IPsec VPN-Profiles
    - VPN Profiles Overview
    - Creating VPN Profiles
    - Editing and Cloning Policies and Objects
    - Assigning Policies and Profiles to Domains
    - VPN Profiles Main Page Fields
  - Shared Objects-Geo IP
    - Creating Geo IP Policies
    - Geo IP Overview
    - Deleting and Replacing Policies and Objects
  - Shared Objects-Policy Enforcement Groups
    - Creating Policy Enforcement Groups
    - Policy Enforcement Groups Overview
    - Deleting and Replacing Policies and Objects
  - Shared Objects-Addresses
    - Addresses and Address Groups Overview
    - Creating Addresses and Address Groups
    - Importing and Exporting CSV Files
    - Assigning Addresses and Address Groups to Domains
    - Showing Duplicate Policies and Objects
    - Addresses Main Page Fields
  - Shared Objects-Services
    - Services and Service Groups Overview
    - Creating Services and Service Groups
    - Importing and Exporting CSV Files
    - Showing Duplicate Policies and Objects
  - Shared Objects-Variables
    - Variables Overview
    - Creating Variables
    - Editing Variables
    - Importing and Exporting CSV Files
    - Showing Duplicate Policies and Objects
  - Shared Objects-Zone Sets
    - Understanding Zone Sets
    - Creating Zone Sets
    - Editing and Cloning Policies and Objects
    - Deleting and Replacing Policies and Objects
    - Finding Usages for Policies and Objects
    - Showing and Deleting Unused Policies and Objects
    - Showing Duplicate Policies and Objects
    - Viewing Policy and Shared Object Details
    - Zone Sets Main Page Fields
  - Sky ATP with Policy Enforcer Overview
    - Policy Enforcer Overview
    - Benefits of Policy Enforcer
    - Policy Enforcer Components
    - Sky ATP Features
    - Comparing the SDSN and non-SDSN Configuration Steps
  - Installing Policy Enforcer
    - Policy Enforcer Installation Overview
    - Deploying and Configuring the Policy Enforcer Virtual Machine
    - Identifying the Policy Enforcer Virtual Machine In Security Director
    - Obtaining a Sky ATP License
    - Creating a Sky ATP Cloud Web Portal Login Account
    - Loading a Root CA
  - Configuring Policy Enforcer Settings (Required Sky ATP, Policy Enforcer, and Cloud Feeds)
    - Policy Enforcer Settings
  - Guided Setup-Sky ATP with Policy Enforcer
    - Using Quick Setup for Sky ATP with Policy Enforcer
  - Guided Setup-Sky ATP
    - Using Quick Setup for Sky ATP
  - Manual Configuration-Sky ATP with Policy Enforcer
    - Configuring Sky ATP with PE (Without Quick Setup) Overview
    - Creating Sky ATP Realms and Enrolling Devices or Associating Sites
    - Secure Fabric Overview
    - Creating Secure Fabric and Sites
    - Editing or Deleting a Secure Fabric
    - Policy Enforcement Groups Overview
    - Creating Policy Enforcement Groups
    - Threat Prevention Policy Overview
    - Creating Threat Prevention Policies
    - Threat Policy Analysis Overview
    - Geo IP Overview
    - Creating Geo IP Policies
  - Manual Configuration-Sky ATP
    - Configuring Sky ATP (No PE and No Quick Setup) Overview
    - Sky ATP Realm Overview
    - Creating Sky ATP Realms and Enrolling Devices or Associating Sites
    - Threat Prevention Policy Overview
    - Creating Threat Prevention Policies
  - Configuring Cloud Feeds Only
    - Configuring Cloud Feeds Only
- Reports
  - Reports
- Administration
  - My Profile
    - Modifying Your User Profile in Security Director
  - Users and Roles-Users
    - Overview of Users in Security Director
    - Creating Users in Security Director
    - Editing and Deleting Users in Security Director
      - Editing Users
      - Deleting Users
    - Viewing and Terminating Active User Sessions in Security Director
      - Viewing Active User Sessions
      - Terminating Active User Sessions
    - Viewing the User Details in Security Director
    - Clearing Local Passwords for Users in Security Director
    - Disabling and Enabling Users in Security Director
      - Disabling Users
      - Enabling Users
    - Unlocking Users in Security Director
    - Users Main Page Fields
  - Users and Roles-Roles
    - Domain RBAC Overview
    - Creating Customized Roles in Security Director
    - Understanding Roles in Security Director
    - Editing, Cloning, and Deleting Roles in Security Director
    - Viewing the Details of a Role in Security Director
    - Importing and Exporting Roles in Security Director
      - Importing Roles
      - Exporting Roles
    - Roles Main Page Fields
  - Users and Roles-Domains
    - Overview of Domains in Security Director
    - Creating Domains in Security Director
    - Editing and Deleting Domains in Security Director
    - Exporting Domains in Security Director
    - Viewing Users, Devices, and Remote Profiles Assigned to a Domain in Security Director
    - Assigning Devices to Domains in Security Director
    - Assigning and Unassigning Remote Profiles to Domains in Security Director
      - Assigning Remote Profiles to Domains
      - Unassigning Remote Profiles from Domains
    - Assigning and Unassigning Users to Domains in Security Director
      - Assigning Users to Domains
      - Unassigning Users from Domains
    - Domains Main Page Fields
  - Users and Roles-Remote Profiles
  - Logging Management
  - Logging Management-Logging Nodes
  - Logging Management-Statistics & Troubleshooting
    - Using the Log Statistics and Troubleshooting
  - Logging Management-Logging Devices
    - Logging Devices Main Page Fields
    - Creating Security Logs
  - Monitor Settings
    - About the Monitor Settings Page
    - Monitor Settings Overview
  - Signature Database
  - Migrating Content from NSM to Security Director
    - NSM Migration
  - Monitoring and Troubleshooting with Security Director Log Collector

Alerts and Alarms Overview

Alerts and notifications are used to notify administrators about significant events within the system. Notifications can also be sent through e-mail.You will be notified when predefined network traffic condition. Alert trigger threshold is number of network traffic events crossing a pre-defined threshold within a period of time. Alarms workspace shows active alarms of devices currently managed by Security Director.

Alerts and notifications provide options for:

Defining alert criteria based on a set of predefined filters. You can use the filters defined in the Filter Management window on the Event Viewer page to generate alerts.
Generating an alert message and notifying you when an alert criteria are met.
Searching for specific alerts on the Generated Alerts page based on alert ID, description, alert definition, alert type, or recipient e-mail address.
Supporting event-based alerts.

For example, If you are an administrator, you can define a condition such that if the number of firewall-deny events crosses a predefined threshold in a given time range for a specific device, you receive an e-mail alert.

Note: If a threshold is crossed and remains so for a long duration, new alerts are not generated. Alerts are generated again when the number of logs matching the alert criteria drops below the threshold and crosses the threshold again.

Understanding Role-Based Access Control for the Alerts and Alert Definitions

Role-Based Access Control (RBAC) has the following impact on the alerts:

Note: You must have Security Analyst or Security Architect role or have permissions equivalent to that role to access the alerts and alert definitions.

You must have the following privileges under Administration > Users & Roles > Roles:

Create Alert Definition under Create Role > Privileges > Alerts > Alert Definitions to create alerts.
Modify Alert Definition to modify alerts.
Delete Alert Definition to delete alerts.
User account under Role Based Access Control to search for user accounts in alert definitions.

Related Documentation

Help us to improve. Rate this article.

Feedback Received. Thank You!

Previous

Alerts and Alarms - Overview

Next

Alerts and Alarms-Alerts

Related Topics

Need more help?

Ask questions in TechWiki

Contact Customer Support

Check documentation in TechLibrary

Rating by you:

X