Ayuda de vídeo de Screencast

don't shows the incidents in SSIM

Created: 15 Nov 2012 | 2 comments
Hello everyone!
I have next very strange problem in SSIM:
After connect via Client to SSIM server I click on tab Incidents and... I see nothing, no one incident. But if I restart SSIM server, then Incidents are appear.
Also to this problem, there is Correlation Rule "Password Guessing Attack" and if I performing testing then SSIM is found incidents, but no shows under tab Incidents. Reboot server doesn't help.    

Comentarios ComentariosIr al último comentario

el cuadro de los Laurent_c

Hi,

I would first try to follow this Kb Article URL http://www.symantec.com/docs/TECH95134

Note that when you test a rule in editor, this does not create incident, just simulate them.

el cuadro de los Chezhin

I would first try to follow this Kb Article URL http://www.symantec.com/docs/TECH95134

This is not for my case. I have the new SSIM server with 5-6 sensors Windows 2008

Note that when you test a rule in editor, this does not create incident, just simulate them

 I know and on this basis I told that this very strange. I have incidents when I perform test of rule, but I don't see any incidents related this rule.