Video Screencast Help
Give us your opinion and win with Symantec! Please help us by taking this survey to tell us about your experience with Symantec Connect, so that we can continue to grow and improve.  Take the survey.

don't shows the incidents in SSIM

Created: 15 Nov 2012 | 2 comments
Hello everyone!
I have next very strange problem in SSIM:
After connect via Client to SSIM server I click on tab Incidents and... I see nothing, no one incident. But if I restart SSIM server, then Incidents are appear.
Also to this problem, there is Correlation Rule "Password Guessing Attack" and if I performing testing then SSIM is found incidents, but no shows under tab Incidents. Reboot server doesn't help.    

Comments 2 CommentsJump to latest comment

Laurent_c's picture

Hi,

I would first try to follow this Kb Article URL http://www.symantec.com/docs/TECH95134

Note that when you test a rule in editor, this does not create incident, just simulate them.

Chezhin's picture

I would first try to follow this Kb Article URL http://www.symantec.com/docs/TECH95134

This is not for my case. I have the new SSIM server with 5-6 sensors Windows 2008

Note that when you test a rule in editor, this does not create incident, just simulate them

 I know and on this basis I told that this very strange. I have incidents when I perform test of rule, but I don't see any incidents related this rule.