Understanding Alerts, Events and Violations

Save PDF

Feedback

Working with SecureSphere Web Application Firewall
Overview
- Introducing SecureSphere Web Application Security
- Available Licenses for SecureSphere Web Security Products
  - Web Application Firewall
  - Threat Intelligence
- Accurate Protection
- Transparent Inspection
- Multi Layer Protection
- The SecureSphere WAF System
- SecureSphere Architecture
- SecureSphere Main Features
- Working with SecureSphere Web Application Firewall
Discovering Network Assets
- Introduction to SecureSphere Discovery and Classification
- Understanding the Discovery Window
- Major Discovery and Classification Tasks
  - Using Service Discovery to Populate a SecureSphere Site
- Working with SecureSphere Scans
- Managing Discovered Servers
  - Analyzing Discovered Servers
    - Viewing Discovered Server Details in Tabular View
    - Viewing Discovered Servers in Graphical Views
- Working with Discovered Servers
Basic SecureSphere Configuration
- Basic Configuration Overview
  - Browser Support
  - Exporting and Importing Individual Objects
- Basic Configuration Guidelines for Gateways, Management Servers
- IPv6 Support
- Basic Site Configuration
- Basic Server Group Configuration
  - Server Group Best Practices
  - Basic Server Group Configuration Tasks
- Understanding Server Group Parameters
- Basic Web Services Configuration
- Managing Web Applications
  - Adding a New Web Application
  - Understanding Web Application Parameters
    - Web Application Definitions Parameters
    - Web Application Applied Policies Information
- General Basic Configuration Tasks
- Configuring Action Sets and Followed Actions
- Activating Settings
Software Update
- SecureSphere Software Update Overview
  - Understanding Families
  - Understanding the Workflow of Software Update
- The Software Update Synchronization Process
  - Online Synchronization
  - Manual Synchronization
- Selecting and Uploading the Software Installation Packages
  - Understanding the Target Version Window
  - Understanding the Procedure for Uploading Software Installation Packages
    - Selecting a Target Version for Update
    - Uploading Software Installation Packages to the MX
- Updating the Software
- Configuring Software Update Settings
Monitoring
- Monitoring Models in SecureSphere
- Understanding Alerts, Events and Violations
  - Monitoring Architecture
- Monitoring Checklist
- Working with the Dashboard
- Managing Alerts
- Managing Violations
- Managing Blocked Sources
  - Viewing Blocked Sources
  - Releasing Blocked Sources
- Filtering Alerts and Violations
- Web Error Pages and Response Pages in Alerts
  - Viewing Web Error Pages and Responses
- Managing System Events
  - Viewing System Events
  - Understanding System Events
    - Understanding the System Events Table
    - Configuring System Events to Interface with 3rd Party Tools
System Monitoring
- Working with Alarms
  - Understanding the Alarm Details Window
- Working with the Alarms History Window
- Configuring Alarms
  - Configuring Alarm Notifications
- Acknowledging Alarms
- Adding a Note to an Alarm
Threat Intelligence Services
- Intelligence (Reputation Services)
- Intelligence (Community Defense)
- Anti Automation (Bot Protection)
  - CAPTCHA
  - ThreatRadar Bot Protection
    - ThreatRadar Bot Protection Dashboard
    - Configuring ThreatRadar Bot Protection
- Emergency Feed Services
SecureSphere API Security
- Protecting Against Parameter Tampering and Malicious Fields
  - Automating API Profiling using the SecureSphere Open API
- Profiling and Protecting API Protocols
  - Session Cookie Protection
- Blocking Malicious Bot Activity and DDoS
- Enforcing API Encryption
- Enforcing Specific API Versions
- Tracking API Users with Client Certificates
Risk Management
- Introduction to SecureSphere Risk Management
- Scanning and Assessing Web Services
- Managing Vulnerabilities
Security Policies
- Introducing Security Policies
- Security Policy Main Tasks
- Network Security Policies
- Securing Web Transport
- HTTP Protocol Signature Policies
- Web Service Custom Policies
- Snippet Injection Policies
- Securing Web Applications
Reporting
- Reports Introduction
- Report Terminology
- Understanding the Reports Window
- Working with Reports
- Creating and Managing Reports
- Filtering Reports
  - Basic Filter Criteria
Web Application Profiles
- Understanding Web Profiles in SecureSphere
- Web Profile Tasks
- Tuning Web Profiles
- Web Profile Graphs
  - Overall Graphs
  - Access Patterns
- Web Profile Optimization
  - Web Profile Optimization Overview
  - Web Profile Optimization Issues
- Web Profile Policy
  - Tuning a Web Profile Policy
    - Viewing a Web Profile Policy
    - Disabling Automatic Web Profiling
- Web APU (Automatic Profile Update)
- Web Profile System Definitions
Signatures
- Working with Signatures
- Working with Dictionaries
- Standard Dictionaries
Advanced SecureSphere Configuration
- Advanced Configuration Overview
  - Identifying Advanced Configuration Requirements
- Applying Policies
  - Applying Security Policies to the Objects in the Sites Tree
  - Applying Security Policies to the Objects in the Applications Tree
    - Working with Application Groups
  - Applying/Unapplying Automatic Application of a Policy to New Server Groups, Services, and Applications
- Managing Archive and Key Settings
  - Managing Keys
  - Defining Archive Settings
  - Configuring and Applying Archive Settings
- Working with Action Sets and Followed Actions
  - Action Sets and Followed Actions Overview
  - Action Set Main Tasks
  - Working with Default Action Sets
  - Creating Custom Action Sets
  - Action Interface Types
  - Configuring Action Interface Parameters
    - Run on Every Event
    - SNMP Traps
  - Assigning Followed Actions
    - Directly Assigning Followed Actions from the Security Policy Window
- Working with Global Objects
  - Summary of Global Objects
  - Creating New Global Objects
  - Working with Global Ports Groups
  - Configuring IP Groups
    - Importing an IP Group from a CSV File
    - Creating an IP Group Individually
- Configuring Sensitive Data Protection
  - Using Sensitive Data Dictionary Groups
  - Masking Data in Elements
    - Adding Parameters to a Data Masking List
    - Attaching a Data Masking List to a Service
- Working with Data Types
  - Creating a New Data Type
- Generic Dictionary Groups
- Configuring Windows Domains
  - Configuring the Default Domain Name
  - Configuring Default Domain Credentials
  - Configuring Active Directory Settings
  - Configuring Kerberos Support
- Protecting and Auditing Custom Information with Lookup Data
  - Predefined Lookup Data Sets
  - Creating a Lookup Data Set
  - Configuring and deleting Lookup Data Sets
- Enriching Data
  - Creating an Enrichment Policy
  - Configuring Data Enrichment Policies
  - Configuring Data Enrichment Policy Rules
  - Configuring Data Enrichment Web Policy Rules
    - Configuring Data Enrichment from a Lookup Data Set
      - Content Hashing in Data Enrichment Policies
- Change Tracking - External Objects
  - Overview of Change Tracking - External Objects
  - Before Running a Change Tracking - External Objects Policy
    - Change Tracking - External Objects Policy Permissions
    - Change Tracking - External Objects - Policy Configuration
  - Creating a New Change Tracking - External Objects Policy
  - Viewing a Change Tracking - External Objects Policy
  - Editing a Change Tracking - External Objects Policy
- Application Structure Modeling
- Working with Tasks
  - Tasks Overview
  - Task Types
  - Understanding the Tasks List
  - Task Followed Action Configuration Guidelines
  - Creating Review Tasks
  - Creating Assignment Tasks
  - Working with Open Tasks
    - Completing Review Tasks
    - Completing Assignment Tasks
- Configuring Preferences
  - Configuring User Details
  - Changing Passwords
  - Configuring User Preferences
- Configuring Syslog
  - Understanding Syslog Fault Tolerance
  - Configuring Available Space for Syslog Buffering (Optional)
- Configuring Integration with Third Party Management Systems
  - Configuring the Gateway's Syslog Client Message Size
  - Configuring Integration with ArcSight
  - Integrating with RSA enVision
  - Archiving to Amazon S3
  - Configuring Integration with BMC Remedy Service Desk
  - Configuring Integration with Active Directory for User Management
- System Event Policies
  - Working with System Events Policies
  - Creating a System Events Policy
  - Importing and Exporting System Event Policies
- Configuring Scheduling
  - Understanding the Execution Plan
- Customizing How SecureSphere Handles Web Traffic
  - Configuring Web Service Restrictions
  - Configuring Restrictions
    - Configuring IP Based Restrictions
      - Configuring Source Restrictions
    - Configuring URL Prefixes / Directory Based Restrictions
      - Configuring URL Prefixes/Directories Group
      - Adding URL Prefixes/Directories Groups to Web Applications
  - Configuring Web Error Page Policies
  - Configuring Advanced Web Service Settings
  - Configuring Gateway HTTP Proxies
  - Configuring OCSP Support
  - Configuring Webworm Protection
    - Configuring Susceptible Directories
  - Configuring Session Tracking
    - Adding Tokens to a Session Tracking List
    - Associating a Session Tracking List to a Web Service
  - Configuring TLS Settings
  - URL Rewrite
  - Supporting Web Load Balancers
  - Validating SSL Client Certificates
- Malware Detection Support
  - Configuring Malware Detection Support
  - Understanding the List of Local IP Addresses Identified as Infected by Malware
    - Displaying Local IP Addresses Identified as Infected by Malware
    - Understanding the Malware Infected Local IP Addresses Table
  - Modifying Advanced Settings for Malware Detection Support
    - Specifying Names and Targets to Exclude from Malware Identification
      - Modifying the Malware Name White List
      - Modifying the Malware Target White List
    - Modifying Threat Levels of Malware Types
  - Configuring Malware Detection Policies
- Working with Base64
- Working with Request Body Signatures
- Working with Content-type Discovery
- Advanced Bridge Mode
  - Setting up ABR
  - Reverting to Bridge Mode
  - ABR Clarifications
- Large Scale MX
  - Setting up Large Scale MX
- Advanced Bot Protection
- HTTP2 Support
- WAAP Anywhere
  - Terminology
  - WAAP Anywhere Architecture
  - Gateway Architecture Highlights
  - Setting Up WAAP Anywhere
  - WAAP Anywhere Clarifications
Reverse Proxies
- Non-Transparent Reverse Proxy
- Transparent Reverse Proxy
  - Configuring a Transparent Reverse Proxy
Attack Analytics
MXs Managed by SOM
- Working with SOM
- Registering MXs
  - Setting Up SSL with Certificate Authentication
  - Removing MXs from SOM
Writing Signatures and Regular Expressions
- Writing Signatures
- Regular Expressions
Plugins
- Plugins Overview
- Order of Plugin Execution
- Configuring Plugins
  - Regular Expressions
  - Associating a Plugin with a Service and Configuring the Plugin
Imperva ThreatRadar Feed Details
- Structure
- Anonymous Browsing
  - TOR IPs
  - Anonymous Proxies
- In-House Serial Attacker Feeds
- 3rd Party Serial Attackers
- Compound Policies
Placeholders
- Working with Placeholders
  - Working with Standard Placeholders
  - Working with Collection Placeholders
    - Understanding Single Collection Placeholders
    - Understanding the Nested Collection Placeholder
- List of Standard Placeholders
  - Correspondence Table
- List of Collection Placeholders
- List of Web Security-Only Placeholders
- Advanced Options
  - DTFormat
- Macros for Use with Placeholders
- Splunk Placeholders
  - List of Splunk Placeholders
- ArcSight Placeholders and Syntax
Rule.dn Associated IDs
- About Rule.dns
- List of Rule.Dn Associated IDs
ArcSight Placeholders and Syntax
- Macros for use with ArcSight Placeholders
- Examples of Syslog Events for ArcSight
- CEF Fields
  - Standard Fields
  - Extended Fields
Appendix Event Types
Filter Criteria and Report Data Fields
- Filter Criteria and Report Data Fields Overview
- Dataset: Lookup Attribute Usage Example
- Alert and Violation Criteria
- Assessment Criteria
- System Event Criteria
- Vulnerability Criteria
- Task Report Criteria
- Configuration Report Criteria
  - Configuration - Sites Report Criteria
  - Configuration Security Policy Report Criteria
- Risk Management Filter Criteria
  - Vulnerability Management Filter Criteria
  - Assessment Results Filter Criteria
- Discovery Report Match Criteria
  - Service Discovery Detailed Report
  - Service Discovery Execution Report
- Discovery Filter Criteria
- Profile Criteria
- Custom Policies Match Criteria
  - Web Custom Policies Match Criteria
- Enrichment Policy Match Criteria
  - Web Service Enrichment Policy Match Criteria
Report Columns
- Columns Available in Alert Reports
  - Alert Report Available Columns
  - Alert Event Available Columns
- Columns Available in Assessment Reports
- Columns Available in System Event Reports
- Columns Available in Vulnerability Reports
- Columns Available in Task Reports
- Columns Available in Configuration Reports
  - Configuration Reports - Sites
  - Configuration Reports - Security Policies
- Columns Available in Discovery Reports
  - Service Discovery Detailed Report Columns
  - Service Discovery Execution Summary Report Columns
- Columns Available in Profile Reports
Pre-Defined Reports
- Alert Reports
- System Events Reports
Alert Aggregation Descriptions
- Alert Aggregation Descriptions
Troubleshooting Hashed Users
Glossary
Copyright Notice
End User License and Services Agreement

HomeWeb Application Firewall User Guide...MonitoringUnderstanding Alerts, Events and Violations

Understanding Alerts, Events and Violations

Also available in:
WAF v14.7
WAF v15.3
WAF v15.2
WAF v15.1
WAF v15.0
Last UpdatedApr 16, 2025
4 minute read

The SecureSphere monitoring lifecycle involves a number of phases and consists of a number of building blocks to keep you up-to-date on the events taking place in your system. Understanding these building blocks and being able to distinguish between them is important to understand how SecureSphere monitors and protects traffic.

Before reviewing the building blocks, it is important to understand that the mechanisms that bring these items to life are policies. Policies are key elements in SecureSphere monitoring. For further information on policies, see Introducing Security Policies.

The following table reviews building blocks used in SecureSphere monitoring.

Monitoring Building Blocks

Search:

Parameter	Description

Regular Event	A generic term for any change or action that has been detected by SecureSphere.
Network Event	An event in network traffic that has been detected by the SecureSphere gateway. There are two types of network events: Learning Event: The discovery of a new item to be protected in the network. Security Event: A violation by network traffic of a security policy.
Learning Event	The discovery of a new item to be protected in the network. A learning event involves the following phases as illustrated in Monitoring Architecture. A network event is detected by SecureSphere Gateway on incoming traffic or by an agent installed on a server in the network. The gateway determines it is a learning event. The learning event is sent to the SecureSphere Management server. The new item to be learned is added to the relevant profile. The first time this item is detected, SecureSphere management server generates a system event. Example: SecureSphere has discovered a new URL in the network. The URL is added to the web profile, a system event is generated and sent to SecureSphere management server with the system event appearing in the System Events window.
Security Event	The discovery of an event that violates a security policy on monitored traffic. Security events themselves are not displayed in SecureSphere, only their resulting alerts and violations. A security event involves the following phases as illustrated in Monitoring Architecture . A network event is detected by SecureSphere Gateway on incoming traffic or by an agent installed on a server in the network. The gateway determines it is a security event. The security event is sent to the SecureSphere Management server. A violation is generated for each policy that has been violated. Violations are analyzed, correlated, then assigned to alerts. SecureSphere correlates and aggregates violations based on known attacks. This helps identify attacks as they take place. Example: SecureSphere detects that a user has violated a policy that determines who can access specific data. A violation is registered and a security alert is created and displayed in the Alerts window.
Violation	An indication that a security event has taken place which violates a policy. A single security event can trigger multiple violations. Violations are displayed in the Violations window, a summary of violations can also be seen in the Details pane of the Alerts window. A violation is generated for each policy that has been violated, unless Server group is in active mode and blocking policy has already been violated by the event, at which point the transaction is blocked and no further action is taken. Example: SecureSphere detects the signature of an SQL injection attack (a security event) which violates a policy. A violation is created and an alert is generated and displayed in the Alerts window. Additionally, the violation appears in the Violations window.
Alert	Notifications that an event or group of events (security events) have taken place that violate a policy. While a violation is an indication of a single security event, an alert is a notification that one or more violations have taken place. A single alert may list up to (aggregate) 30 violations. Example: SecureSphere determines that the checksum of a cookie signature is incorrect. This violates a policy that generates an alert which is displayed in the Alerts window, with the violation details appearing in the Violations window.
Aggregation	The process of grouping related violations into a single alert to assist in identifying attacks. If an aggregation already exists related to the generated violation, the new violation is added to it. If no related aggregation exists, a new aggregation is created and future related violations are added to this aggregation. Violations are displayed in the Violations window. Example: SecureSphere detects that similar signatures have been detected in traffic from a number of different sources. Violations are aggregated and an attack is identified as being from e-mail collector robots.
System Event	An event related to the system, including user login, system errors and warnings, updates, items added to a profile for learning, and changes to configuration. System events may have compliance implications. A System Event in SecureSphere is not considered an alert. Instead, system event notifications are displayed in the System Events window. For an illustration of how system events are generated, see Monitoring Architecture. Example: SecureSphere adds a item to learning it has detected, or an Administrator logged into the system. An event is created and displayed in the System Events window.

Was this topic helpful?

Like Dislike

Web Application Firewall User Guide

Filters

Source Type

Application Security

Data Security

Network Security

Application Performance

Product Versions

Hypervisor Installation

Document Type

Access

Product Area