Closing alerts
When you close an alert, or incident, a dialog lets you select a reason, and specify the learning process.
The Reason for closing dropdown has these options:
- This is a change: If the cause of the alert is an intended
change to the network, such as:
- A new computer being attached
- New communication between two nodes that were not previously communicating
VI:NEW-NODEalert is closed as a change, Guardian registers that the corresponding node is part of the environment and will not raise subsequentVI:NEW-NODEalerts about the same node. - This is a change: If the cause of the alert is an intended change to the network, such as a new computer being attached, or a new communication between two nodes that were not talking before, the change detected by Guardian can be learned as part of the environment baseline. When closing an alert in this way, the IDS is instructed to learn the corresponding objects. For example, when a VI:NEW-NODE alert is closed as a change, Guardian registers that the corresponding node is part of the environment and will not raise subsequent VI:NEW-NODE alerts about the same node.
- This is an incident: If the cause of the alert is a configuration error, an attack, a malfunctioning device, or other security incident, the change is not learned as part of the environment baseline. When closing an alert in this way, the IDS is instructed to delete the corresponding objects. For example, a new node entering the network for the first time causes a VI:NEW-NODE alert. If an alert closes as an incident, reference to the new node is deleted. The VI:NEW-NODE alert is raised again in subsequent communication involving the same node.
- Custom reason: This lets you write a custom reason for closing an alert. You can enter a text string as the closing reason, with a request to apply one of the two described behaviors.
You can add a comment so that it shows in the alert audit log.
