HTML reports

[rossr]

This may sound like a stupid question, but when I run an IDS summary report, I select High and Medium level alarms. The resulting report shows alarm levels 3 and 5, but no 4. Is there a level 4? I wouldn't normally ask a question such as this, but executive types like to ask questions like this - and unfortunately you need an answer other than "Not sure why."

[rossr]

sorry forgot to mention I'm using CSPM, which may be the problem - CSPM only know HIGH, MEDIUM, and LOW, correct? Whereas the sensors use the level of alarm 1-5. Can someone validate my thinking?

[marcabal]

Since CSPM knows only High, Medium, Low it took the 5 levels from the sensor and changed them so High=5, Medium=3, and Low=1. If it downloaded the configuration from the sensor which had levels 2 and 4, it would change 4 to 5 so it would then be High, and changes 2 to 1 so it would then be low.

So if the sensor is configured by CSPM you will only ever see 1,3 and 5 alarms, but if hte sensor is configured manually or br the Unix Director then you could see level 2 and 4 alarms which would then be mapped to level 1 and 5 alarms.