There should be a way to prioritize incidents without the asset being on asset table, for example if any machine was part of 2 or more incidents within a day then changing the severity to 5. (Security, Symantec Security Information Manager, ...

There should be a default query on finding the number of times an Rule was triggered in a month or for specific time period. This is very important for repoting purpose, they should also bein a such way that Open, in-work and closed incident can be ...

There should be a way to search an IP/Hostname on the incident list. Currently there is no way of knowing how many incident an Server/machine is generating. i.e. Want to know how many incident was generated by a machine in past week or today.   ...

Would like to see more technology based generic rules in SSIM that would work regargless of any product used. Like Port Scans and Port Sweeps. BOT Rules needs to be modifed or more IRC ports added. Also if there can be addition on technology ...

To create a SERT disc you have to logon to Symantec, give a key, download an iso, burn it to a disc, and add definitions or allow SERT to download them ( I have never been able to get the iso to see whether the program can update its own ...