I need some statistics about my IDS activity. I am interested in getting the number of events generated for a week. I would need them sorted by severity as well.
Something like :
Total event : 1000 000
High severity : 500 000
Medium severity : 200 000
Low & informationnel : 300 000
I don’t think I can create a customize report so I’ve gathered the information from differents default reports.
I chose 2 reports. The first one, called "Daily Metrics Report", provides the total number of events. Let’s say this number is 1000 000. The second, called "IDS Summary Report", provides statistics about alarms sorted by severity.
As I only log medium and high severity events, the "IDS Summary Report" only shows the number of medium and high severity events . In the « Alarms by Source and Destination Direction » section, let’s say the high severity number is 500 000 and the medium severity one is 200 000. It’s also written that high severity events represents 25% of the total alarms. This is what I don’t understand : I would rather say 50%.
Where does this 25% come from? Are events and alarms not the same things? For example, do some events generate more than one alarm ?
If so, what report can I use to have my information ?
Does anyone know where to find some information about the meaning of the field in the default reports or in the statistics listed in the monitor/statistics section.
One more question to understand how events are managed : the security monitor doesn’t store events in a database but retrieve alarms from each IDS’ event store, depending on the query specification , doesn’t it ?
Thank you
