Alerts
The appliance continuously monitors the network for any deviations from the established firewall rules. Utilizing the OPSWAT policy engine, it flags any changes made by unauthorized users or messages that fall outside the defined parameters. These policies come pre-configured on the appliance.
A policy consists of a set of rules designed to prevent specific actions from occurring. By applying these policies, you can block all actions that are specified within them.
See and acknowledge Events
Click the Events menu. The Events pane displays all Events, in sequence of newest events first, then unacknowledged events, and acknowledged events last.
You can see details for an event in each row. Repeated events with the same Source, Device, Protocol, and Events are incremented in one row until you acknowledge it.
- ID: A special number for this event
- Date: Date the appliance first recorded the event in the format MM:DD:YYYY HH:MM:SS
- Source: IP address that sent the communication
- Device: IP address of the device receiving the communication
- Protocol: Rules that dictate how to format, transmit, and receive data that let devices communicate. For example, Modbus or TCP.
- Port: Port that this protocol connects to the network.
- Event: Short description of the event type
- Occurrences: If this event has occurred more than once, they are summarized under one row. This column shows the number of occurrences that are summarized.
- Acknowledged: (Protected Assets only) Shows an Acknowledge button or the date and time that the event was acknowledged. To acknowledge an event or many occurrences of the same event, examine the cause and refer to your local procedures to do the necessary steps.
- Comment: (Protected Assets only) When you acknowledge an event, you can enter text to give more information about the event and steps you did to accept or correct it. This text shows here. If your browser is set to full screen, this will be the last column.
To view a subset of events for protected or non-protected assets, click the Filters menu and select a filter. The selected filter displays on the left side of the pane. Click the ‘x’ next to the displayed filter name to remove the filter and view all events.
If the browser window is smaller, the last row’s headings are under a plus sign (+) in the first column. Click the + to see their contents.
Click the Acknowledge button to examine an unacknowledged event and correct it. The [Acknowledge Event pane](Acknowledge Event pane) displays. You can also open the Action menu and click Acknowledge All to acknowledge all unacknowledged Events:
- Type: Type of event. This shows in the Events pane under the Event column.
- Source IP: IP address that sent the communication
- Destination IP: IP address of the device receiving the communication
- Destination Port: Communication travels through this port
- TCP: Connection type. TCP (Transmission Control Protocol) is connection oriented, tracks all data it sends, and requires frequent acknowledgements from the receiving end. This makes sure that all data reaches its destination.
- Protocol: Rules that dictate how to format, transmit, and receive data that let devices communicate. For example, Modbus or TCP.
- Description: Type of action the appliance did on this communication
- Occurrences: If this event has occurred more than once, they are summarized under one row. This column shows the number of occurrences that are summarized.
- Comment: Enter text to give more information about the event and steps you did to accept or correct it. Refer to your local procedures for steps to correct these.
Click the Save button. A green banner at the top tells you that the procedure is successful. The Events pane displays with the Comment showing for that event.
To review an event’s details, click in its row on the Event pane.
Export events
Exporting events is usually used a diagnostic tool. You can export events for protected and non-protected assets.
1) Click the Events menu.
2) Select the desired tab.
3) Open the Action menu and click Export.
4) Click to either Open the file or Save it to your default download folder. The default location for Windows systems is C:\Users<your user name>\Downloads.
Delete events
You can delete events associated with protected or non-protected assets.
1) Click the Events menu.
2) Select the desired tab.
3) Open the Action menu and click Delete All.
4) Click the Submit button to confirm your decision.