5.5. Anomalies

You can view list of network incidents in the 'Anomalies menu'. Every incident consists of one or more alerts; every alert consists of one or more anomalies. You can use list filtering, i.e. by time range (current hour, last 3 hours, 24 hours, 3 days, 7 days, 14 days, 31 days or any time), by severity (only critical, urgent or higher, important or higher, warning or higher, or any severity), by related network (only internal networks, only external networks, any network), and by state (new, solving, resolved, archived or any state).

Figure 5.26. Anomalies window.

Anomalies window.

Host name resolving is disabled in default setting, but you can click on 'resolve hostnames' to receive full hostname. The other option gives you the possibility of viewing only network groups instead of full hosts IP addresses. The last option is used for periodical refreshing of the selected page. If you enable this option page it will be refreshed in 1 minute interval. This option is very often used by network security operators.

A list of detected network incidents is available below the filter window. You may order rows by clicking on the field header (click for the second time to descendant order).

By clicking on the source and/or destination (if available) you will receive a list of available actions for each row (i.e. anomaly exclusion, IP address information, more deep searching via Data->Search etc.). To view incident detail (and a list of alerts) click on the 'View detail' link. In the 'List of alerts' you may type in your comments, set state of incident, report incident to the email address or view anomaly details. See chapter Configuration - Anomalies and Appendix 3 for more information about network anomalies.