HP X Unified Security Platform Series User Manual download pdf (Page 126)

Chapter 5 Events: Logs, Traffic Streams, Reports

110 X Family LSM User’s Guide V 2.5.1

Managed Streams

The Managed Streams menu pages provide options to review and manage traffic streams that have

been blocked, rate-limited, or quarantined by IPS policies. These events are captured by the Threat

Suppression Engine (TSE), which uses a blend of ASICs and network processors to detect threats and

anomalies in network traffic.

The traffic streams include the following:

• Blocked streams— Traffic streams detected and blocked based on filters configured with a Block

action set.

• Rate-Limited streams — Traffic streams detected and rate limited based on filters configured with

a Rate-Limit action set.

• Quarantined streams — Traffic streams detected and blocked based on filters configured with a

Quarantine action set, or quarantined manually.

For details, see the following topics:

• “Blocked Streams” on page 110

• “Rate Limited Streams” on page 112

• “Quarantined Addresses” on page 113

• “Action Sets” on page 44

Blocked Streams

When traffic triggers an IPS filter that has been configured with a Block or Block+Notify action, traffic

from the source IP address and port is blocked and an entry is added to the Blocked Streams page,

based on the contact configuration in the action set. From the Blocked Streams page, you can:

• View and search for information on blocked streams

• Manually terminate all or selected blocked stream connections

Figure 5–1: Blocked Streams Page

1 ... 125 126 127 ... 333

No comments

HP X Unified Security Platform Series User Manual Page 126