Video Screencast Help

don't shows the incidents in SSIM

Created: 15 Nov 2012 | 2 comments

 

Hello everyone!
I have next very strange problem in SSIM:
After connect via Client to SSIM server I click on tab Incidents and... I see nothing, no one incident. But if I restart SSIM server, then Incidents are appear.
Also to this problem, there is Correlation Rule "Password Guessing Attack" and if I performing testing then SSIM is found incidents, but no shows under tab Incidents. Reboot server doesn't help.    

Comments 2 CommentsJump to latest comment

Laurent_c's picture

Hi,

 

I would first try to follow this Kb Article URL http://www.symantec.com/docs/TECH95134

 

Note that when you test a rule in editor, this does not create incident, just simulate them.

Chezhin's picture

I would first try to follow this Kb Article URL http://www.symantec.com/docs/TECH95134

This is not for my case. I have the new SSIM server with 5-6 sensors Windows 2008

 

Note that when you test a rule in editor, this does not create incident, just simulate them

 I know and on this basis I told that this very strange. I have incidents when I perform test of rule, but I don't see any incidents related this rule.