don't shows the incidents in SSIM
Created: 15 Nov 2012 | 2 comments
Hello everyone!
I have next very strange problem in SSIM:
After connect via Client to SSIM server I click on tab Incidents and... I see nothing, no one incident. But if I restart SSIM server, then Incidents are appear.
Also to this problem, there is Correlation Rule "Password Guessing Attack" and if I performing testing then SSIM is found incidents, but no shows under tab Incidents. Reboot server doesn't help.
Discussion Filed Under:
Comments 2 Comments • Jump to latest comment
Hi,
I would first try to follow this Kb Article URL http://www.symantec.com/docs/TECH95134
Note that when you test a rule in editor, this does not create incident, just simulate them.
This is not for my case. I have the new SSIM server with 5-6 sensors Windows 2008
I know and on this basis I told that this very strange. I have incidents when I perform test of rule, but I don't see any incidents related this rule.
Would you like to reply?
Login or Register to post your comment.