List of events

The screen consists of three columns, as well as a help page at the end of the line for each event type.

Username This field shows the number that identifies the event. It cannot be edited.
Level This column shows the default alarm levels assigned to events.

There are 4 levels, which you can modify by selecting the desired level from the drop-down list. This list appears when you click on the downward arrow on the right:
  • Ignore: No logs on the event will be kept.
  • Minor: As soon as the event concerned is detected, a minor alarm will be generated. This alarm is transferred to the logs, and can be sent by Syslog (Logs – Syslog) or by e-mail (see module E-mail alerts).
  • Major: As soon as the event concerned is detected, a minor alarm will be generated. This alarm is transferred to the logs, and can be sent by Syslog (Logs – Syslog) or by e-mail (see module E-mail alerts).
  • Log: The Stormshield Network firewall does not do anything. This is useful when you wish to log only certain types of traffic without applying any particular action.

Message (language depends on the firewall language)

This field shows the name of the system event and its characteristics (cannot be edited).

NOTE
By clicking on the arrow on the right side of the column header, you can invert the order in which events appear.
Open help When you select an event from the list by clicking on it, a “Show help” link appears.

Clicking on this link will take you to the Stormshield Network knowledge base, providing more details on the
information relating to the event.
Configure Send an e-mail: an e-mail will be sent when this alarm is raised (cf. module E-mail alerts) with the following conditions:
  • Number of alarms before sending: minimum number of alarms required before an e-mail is sent, during the period defined hereafter.
  • During the period of (seconds): period in seconds during which alarms have been raised, before an e-mail is sent.
  • Quarantine host: the packet that caused the alarm will be blocked with the following parameters. To remove a packet from quarantine, use Stormshield Network Realtime Monitor.
  • for a period of (minutes): duration of the quarantine

GENERAL NOTE
When you modify the alarm level of an event, don’t forget to click on Apply at the bottom of the page, in order to confirm your action.