Watchguard Firebox X1000 Betriebsanweisung PDF herunterladen (Seite 187)

User Guide 171

CHAPTER 13 Setting Up Logging and

Notification

An event is any single activity that occurs at the Firebox, such as denying a

packet from passing through the Firebox. Logging is the recording of these

events to a log host. A notification is a message sent to the administrator by

the Firebox when an event occurs that indicates a security threat.

Notification can be in the form of email, a popup window on the

WatchGuard Security Event Processor (WSEP), a call to a pager, or the

execution of a custom program.

For example, WatchGuard recommends that you configure default packet

handling to issue a notification when the Firebox detects a port space

probe. When the Firebox detects one, the log host sends notification to the

network security administrator about the rejected packets. At this point,

the network security administrator can examine the logs and decide what

to do to further secure the organization’s network. Some possible courses

of action would be to:

• Block the ports on which the probe was attempted

• Block the IP address that is sending the packets

• Contact the ISP through which the packets are being sent

Logging and notification are crucial to an effective network security

policy. Together, they make it possible to monitor your network security,

identify both attacks and attackers, and take action to address security

threats and challenges. WatchGuard logging and notification features are

1 2 ... 182 183 184 185 186 187 188 189 190 191 192 ... 270 271

Keine Kommentare

Watchguard Firebox X1000 Betriebsanweisung Seite 187