H3c-technologies H3C Intelligent Management Center User Manual Page 28
- Page / 84
- Table of contents
- BOOKMARKS
Rated. / 5. Based on customer reviews
19
f. From the Traffic Analysis Log Aggregation Policy list, select one of the following aggregation
policies:
− No Aggregation (Best Report Timeliness)—The UBA server does not aggregate data, and
it processes each flow record. This option is only suitable for scenarios that have a priority
on report timeliness, which require the most disk space.
− Aggregation (Standard)—The UBA server aggregates data at a fixed interval. This option
requires less disk space than the No Aggregation aggregation policy and more disk space
than the Aggregation (Rough Granularity) aggregation policy.
− Aggregation (Rough Granularity)—The UBA server aggregates data at an interval longer
than that of the Aggregation (Standard) aggregation policy. This option is suitable for
scenarios that have a small number of logs generated, which requires the least disk space.
g. From the Filter Policy list, select a predefined filter policy. Select Not Filter if you do not want
to filter flow records.
For more information about configuring a filter policy, see "Managing filter strategies."
h. In the Usage Threshold of the Database Disk (1-95%) field, enter a usage threshold of the
database disk.
4. When the usage threshold of the database disk is reached, the UBA database space
management module is triggered to inform the IMC alarm management module to generate
alarms. The IMC alarm management module then sends notifications to inform administrators of
the alarms. For more information about the UBA database space management module, see
"Managing database space." For more i
nformation about the IMC alarm management module,
see HP IMC Platform Administrator Guide.
a. From the When Database Disk Usage Reaches Threshold list, select the action you want UBA
to take when the UBA database disk usage reaches the threshold set in Usage Threshold of
the Database Disk (1-95%) field. Options are:
− Stop Receiving Logs—The UBA server stops monitoring network data and stops receiving
flow records.
− Delete Logs to Release Space—The UBA server deletes oldest logs from the database until
the disk space usage drops below the threshold.
5. In the Device Information area, select the devices that send flow records.
6. In the Probe Information area, select the probes that send flow records and enable the special
audits as needed for each selected probe.
You can add audit tasks of special audit types only after you enable the corresponding special
audits and successfully deploy the server configuration.
7. In the Intranet Monitor Information area, enter an IP segment to be monitored in the Intranet
Information field, and click Add.
The IP segment uses the format of 10.153.89.0/24, 10.153.89.0/255.255.255.0, or
a001:410:0:1::1/64.
To delete an IP segment, click the Delete icon
for the IP segment.
8. Click Deploy.
The Configuration Deployment Result page appears and displays the processor deployment result,
receiver deployment result, and the probe deployment result.
9. Click Back to return to the Server Management page.
- Preface 3
- Network topology icons 4
- Obtaining documentation 5
- Technical support 6
- Documentation feedback 6
- Contents 7
- 1.Overview 10
- Processing flow records 11
- 2.Quick start guide 12
- Navigation tree pop-up menus 14
- UBA workflow 15
- Common operations 16
- Setting the query time 17
- Customizing UBA lists 18
- 3.Settings 19
- Managing UBA data sources 20
- Managing probes 24
- Adding a probe 25
- Modifying a probe 25
- Deleting a probe 25
- Managing UBA servers 26
- Managing user behavior audit 29
- Managing database space 30
- Managing data export 32
- Managing applications 34
- Querying applications 35
- Adding an application 35
- Batch importing applications 37
- Modifying an application 37
- Deleting an application 38
- Managing system parameters 39
- Managing filter strategies 40
- Adding a filter strategy 41
- Managing anomaly detection 42
- DHCP Offer Packet 47
- DNS Rogue Hack 47
- Large ICMP Packet 47
- Ping of Death Attack 47
- 4.Managing general audit 48
- Adding a general audit task 49
- Deleting general audit tasks 52
- 5.Managing NAT audit 53
- Adding a NAT audit task 54
- Modifying a NAT audit task 57
- Deleting NAT audit tasks 57
- 10.153.89.0 59
- 10.153.89.* 59
- 1.1.1.1-2.2.2.2 59
- 7.Managing FTP audit 63
- Adding an FTP audit task 64
- Modifying an FTP audit task 66
- Deleting FTP audit tasks 66
- 8.Managing mail audit 67
- Adding a mail audit task 68
- Modifying a mail audit task 70
- Deleting mail audit tasks 70
- User behavior audit 71
- User behavior audit analysis 71
- 11.UBA configuration example 77
- Software version used 78
- Configuring UBA 79
- Verifying the configuration 82
Related products and manuals for Safety H3c-technologies H3C Intelligent Management Center
(160 pages)© 2020, manymanuals.com. All rights reserved. | 0.331 s |
Manymanuals.com
Manymanuals.de
Manymanuals.fr
Manymanuals.it
Manymanuals.pl
Manymanuals.cz
Manymanuals.es
Manymanuals-pt.com
Comments to this Manuals