05 - Correlation Alert - Threshold alert.pptVIP

* * * * * * * * * * * * * * * * Thanks for participating in this presentation! * ? 2009 IBM Corporation ? 2009 IBM Corporation Correlation Alert Agenda Correlation Alert Feature Analysis Review “seed” data in VM 10.10.9.56 Create a query to be used by the Correlation Alert Create a Correlation Alert Generate traffic View the results within Incident Management Correlation Alert - Feature analysis An alert is a message indicating that an exception or policy rule violation was detected. Alerts are triggered in two ways: A correlation alert is triggered by a query that looks back over a specified time period to determine if alert threshold has been met. The Guardium Anomaly Detection Engine runs correlation queries on a scheduled basis. By default, correlation alerts do not log policy violations, but they can be configured to do that. A real-time alert is triggered by a security policy rule. The Guardium Inspection Engine component runs the security policy as it collects and analyzes database traffic in real time. Correlation Alert - Feature analysis Regardless of how they are triggered, Guardium logs all alerts the same way: the alert information is logged in the Guardium internal database. The amount and type of information logged depends on the specific alert type. The Guardium Alerter component, which also runs on a scheduled basis, processes each new alert, passing the logged information for each alert to any combination of the following notification mechanisms: SMTP – The SMTP (outgoing e-mail) server. The Alerter passes standard email messages to the SMTP server for which it has been configured. SNMP – The SNMP (network information and control) server. When SNMP is selected for an alert notification, the Alerter passes all alert messages of that type to the single trap community for which the Alerter has been configured. Syslog – The alert is written to syslog on the Guardium appliance (which may be configured by the Guardium Administrator to write syslo