Sentinel: Active Views Tab – Description

Event views are formatted as tables. Active view configuration is determined by the das_rt.xml file. A near Real Time Event Table with graphical presentation and Snapshot are the two types of Active Views.

• Near Real Time Event Table

  • Holds up to 750 events per 30-second period.

  • By default, the client maintains a 24-hour period of cached events. This is configurable through Active View Properties.

  • By default, the event table will display a maximum of 30,000 events. This is configurable through Active View Properties.

  • By default, the event table refreshes every 30 seconds (send time delay). This represented by a gray line in the event table.

  • In the event when there are more than 750 per 30-second time period, a red separation line will appear indicating that there are more events than what is displayed.

  • When saving user preferences, it will continue to collect data for 4 days. For instance, if you save your preferences, log out and log back in the following day your Active View will be display any data as if you never logged off.

  • If an Active View is created and not saved, it will continue to collect data for an hour. Within that hour time frame if an identical Active View is created, the Active View will display data for the last hour.

• Snapshot - time-stamped views of a Real Time Event View table.

The following is what makes an Active View unique.

• Filter assigned to an Active View

• The z-axis attribute

• The security filter assigned to a user

The Active Views Tab allows you to:

• Reconfigure Active Views

• Add Events to an incident

• Close a Snapshot or a Visual Navigator Window

• Create an incident

• Custom Menu Options with Events

• Delete a Snapshot or a Visual Navigator Window

• Event Query

• Graph Map

• View Advisor Data

• Manage Columns

• Send messages about Events by e mail

• Show or Hide Event Details

• Snapshot of a Visual Navigator Window

• View Events that triggered a correlated event

• View Vulnerability Visualization

• View Asset Data

A user can change values (column names) to display logical names and have it populate throughout the system. Apply attributes to the event stream that are relevant. For more information, see Sentinel Data Manager, the Wizard User's Guide and e-Security User Reference Guide.