| Sensor alerts are stored on each sensor and then periodically transferred to a central management or logging server database. Centrally logging the sensor information provides a central location to store, view, analyze, and produce detailed reports on alerts. Auditing and logging are key components of any security architecture. Logging the actions of specific events provides detailed information about the attack which is invaluable for us in investigating the attack, recognizing resource utilization or capacity thresholds, or to simply identify an improperly configured IDPS. Many events, such as configuration changes and login success or failure are mandated by this control; however, organizations may also define additional events for logging. The sensor's primary responsibility is to monitor its network segment for suspicious activity. The management console is a central management, auditing, and data storage point for a large number of sensors. |
