To zoom in on the map, click a location on the map. The Threat Map updates to show the selected data. From the drop-down list at the top-right corner of the Threat Map, select a pivot option. To see more information about the threats on the map: To see information about the unknown IP addresses, click Unknown.Ī dialog box appears with this information for each IP address from an unknown location: If there are IP addresses from unknown geographical locations for the selected view, the Unknown link appears at the top of the map and includes the number of addresses that are unknown. Light green - Medium number of allowed events. Bright green - High number of allowed events. Orange - Medium number of denied events. The colors that appear in the map indicate the number of hits in each geographical location for the selected view. From the drop-down list at the top-right corner of the Threat Map, select an option to pivot on this data and change your view of the Threat Map:. From the Start and End drop-down list calendars, select the start and end dates and times to include in the report data, then click Apply. If the Firebox or group has a management connection to Dimension, the Device Summary page opens. If the Firebox or group has only a logging connection to Dimension, the Executive Dashboard page opens. 
Select Home > Devices or Home > Groups.For an IP address, this includes a list of all hits, whether it is the source or the destination address, and whether the traffic was allowed or denied. For a country, this includes a list of protocols, cities, IP addresses, and hits. The Blocked Botnet Sites view shows the source and destination IP address of the botnet site.Īfter you select an option in the Threat Map to pivot on, you can click on the details (such as a country or an IP address) to get additional information. The Denied Packets and Intrusion Prevention Service views use the source IP address for the location of the traffic. For the Web Traffic, Application Control, and All Traffic views, the destination IP address is used for the location of the traffic. You can pivot on the information in the Threat Map for the source and destination IP addresses (IPv4 or IPv6), based on the view you select. All Traffic - Shows only allowed events.Application Control - Shows only allowed events.Web Traffic - Shows only allowed events.
Intrusion Prevention Service - Shows only denied events. Blocked Botnet Sites - Only appears if botnet traffic is included in the log messages. Denied Packets (Blocked) - Shows only denied events. The Threat Map shows only the event types associated with the detailed view you select: Threat Map is a visual representation of the source and destination locations around the world for the traffic through your Firebox.
0 kommentar(er)
