Use the following displays and options to navigate through the Event Manager display.
Incidents, Threats, and Highlights Summary Totals
In the Event Manager header bar, a summary of all the open incidents, threats and highlighted events is shown. This gives a quick, at-a-glance view of what is currently posing a security risk against your business assets.
The summary counts are taken from the events for each audit control against which an event has been logged.
Time Range
The Time Range setting within Event Manager can be used to amend the current display to a specific time band, so that the listed events can be as recent or as historic as needed.
Click Time Range in the Event Manager menu bar to display a drop-down menu from which a time range period selection can be made. Once a new time range is selected, the display changes to the show the events recorded in the selected time period.
Regulations
The Regulations setting can be used to limit the events displayed to just those impacting on a specific, or number of International and/or internal security regulations, that must be met in order for your business to remain in compliance.
Click Regulations in the Event Manager menu bar to display a drop-down menu from which a single or multiple regulation selections can be made. Click OK to apply the setting. Once the selected criteria have been applied, the display changes to the show the events that currently affect these regulations.
Hide or Show Closed Events
Within the main display of the dashboard, it is possible to show or hide events that have been closed by users of the Event Manager.
Use the slider control in the Event Manager menu bar to show or hide closed events as required. The default setting is to hide closed events.
Event Analysis
Click on an event that is listed on the Event Manager display to be able to review or inspect it in further detail in the Event Summary Display.
The Event Summary typically shows the following information:
- Event Time - The time at which the security event was logged.
- Action Performed By - The name of the user profile that initiated the action.
- From workstation - The name of the device from which the action was initiated
- Action - The name of the Action audit control event that was triggered.
- Action Performed On - The name of the file or program on which the action was performed.
- On Workstation - The name of the workstation on which the action was performed.
- Complete Message - Provides the complete message detail of the event.
- Audited On - The name of the machine on which the action was audited
- Controlled by - The name of the security event control under which this event was raised
Assigning the Event to different Reviewer
When the event is first raised it is assigned to the reviewer who has been designated to review the specific type of events. This setting is defined when setting Security Controls.
To change the reviewer of this event, click Assign to another reviewer in the Event header bar.
The Change Review dialog is displayed allowing you to select a different person to assign the event for review. Use the vertical scroll bar to view additional user profiles to which the event can be assigned. Click Add New to add a new reviewer profile. Click OK to save and confirm the change.
Event Review
Options in the Event Review section of the analysis screen allow you to determine whether the event is rated as a security incident and whether or not it is still live.
- Event was an Incident - Check this box to indicate that this event is classed as a security incident. If classed as an incident, this event appears as an incident count in the Incidents, Threats and Highlights Summary in the Event Manager header bar. Once the event has been identified as an incident, the level of Security risk needs to be determined. Select from Low, Medium or High.
- Still Under Analysis? - Use this setting to determine whether the event is still open or can be closed as a result of this review.
- Yes - This event requires further analysis so leaves it open so it can be reviewed.
- No - The event has been reviewed and no further action is required, so it can be closed. Enter a comment to explain how the event was resolved.
Click Apply Changes to confirm and save the review settings.
Bulk Review of Events
Rather than going into each event separately and reviewing it, it is possible to perform a bulk review of events and apply the same condition to all the events in a single action. There are two ways of performing a bulk review.
- Applying a Multi-select Option to Every Event on the Page
- Selecting All Events That Match This Filter
Applying a Multi-select Option to Every Event on the Page
This can be achieved by clicking in the square of the first column in the header bar as shown in the screen shot below.
All events on the page are now selected. The following options can now be taken.
- Change Reviewer: Click Change Reviewer to open the Change Reviewer window from where a new reviewer can be chosen and applied to all the selected events.
- Add Comment: Enter a comment in the comment box and click the
Comment icon to apply the same comment to all the selected events. - Close: Click the
Close icon to open the Close Confirmation window where a comment can be added to explain the resolution.
Click Refresh to update the display with the result of the bulk action review.
Selecting All Events That Match This Filter
Click in the square of the first column in the header bar as before when applying a multi-select option to every event on a page.
Click Select All Events Matching This Filter.
This performs a bulk review on any events that match the filter, regardless of the page on which it is located.
You have the same options as available as when applying a multi-select option to every event on a page.
Click Refresh to update the display with the result of the bulk action review.
Event Activity
The Event Activity section of the Event Analysis display is used to display any human and, if required, automatically generated annotations and comments required the event.
- Show Automatic Annotations - This setting is enabled by default. Any actions that are applied to this event, such as change of a reviewer, for example, are shown in the activity section, providing you with an audit trail of the event history.
Adding a Comment
Use the Comment text box to enter any details that are relevant to the event and to which other reviewers should be made aware. Click Comment to add the comment to the current Event activity.