H3C Technologies H3C SecCenter UTM Manager - Manual (Page 184)

176
Figure 166 Add an event rule
Table 155 Event rule configuration items
Item Description
Threshold
Optional
If filters of a rule are all matched for or more than the specified times (Threshold) during
the specified Interval, the rule is matched.
• Interval: A time period in seconds, and defaults to 5 seconds.
• Threshold: Number o times the attack matches the rule, and defaults to 1.
Device
Required
Select security devices from which the SecCenter system receives log data for analysis.
Source IP
Optional
Specify source IP addresses as the match criteria. Invert selection is supported.
Destination IP
Optional
Specify destination IP addresses as the match criteria. Invert selection is supported.
Source Port
Optional
Specify source ports as the match criteria. Invert selection is supported.
Destination Port
Optional
Specify destination ports as the match criteria. Invert selection is supported.
Protocol
Optional
Specify protocols as the match criteria. Invert selection is supported.