HPE6-A84 · Question #8
A company has Aruba gateways that are Implementing gateway IDS/IPS in IDS mode. The customer complains that admins are receiving too frequent of repeat email notifications for the same threat. The…
The correct answer is B. Alert duration and threshold settings. Alert duration and threshold settings are used to control how often and under what conditions email notifications are sent for gateway IDS/IPS events. By adjusting these settings, the customer can reduce the frequency of repeat email notifications for the same threat, while…
Question
A company has Aruba gateways that are Implementing gateway IDS/IPS in IDS mode. The customer complains that admins are receiving too frequent of repeat email notifications for the same threat. The threat itself might be one that the admins should investigate, but the customer does not want the email notification to repeat as often. Which setting should you adjust in Aruba Central?
Options
- AReport scheduling settings
- BAlert duration and threshold settings
- CThe IDS policy setting (strict, medium, or lenient)
- DThe allowlist settings in the IDS policy
How the community answered
(22 responses)- A5% (1)
- B91% (20)
- D5% (1)
Explanation
Alert duration and threshold settings are used to control how often and under what conditions email notifications are sent for gateway IDS/IPS events. By adjusting these settings, the customer can reduce the frequency of repeat email notifications for the same threat, while still being informed of any critical or new threats. To adjust the alert duration and threshold settings in Aruba Central, the customer can follow In the Aruba Central app, set the filter to Global, a group, or a device. Under Analyze, click Alerts & Events. Click the Config icon to open the Alert Severities & Notifications page. Select the Gateway IDS/IPS tab to view the alert categories and severities for gateway IDS/IPS events. Click on an alert category to expand it and view the alert duration and threshold settings for each Enter a value in minutes for the alert duration. This is the time period during which the alert is active and email notifications are sent. Enter a value for the alert threshold. This is the number of times the alert must be triggered within the alert duration before an email notification is sent. By increasing the alert duration and/or threshold values, the customer can reduce the number of email notifications for recurring threats, as they will only be sent when the threshold is reached within the duration. For example, if the customer sets the alert duration to 60 minutes and the alert threshold to 10 for a Critical severity level, then an email notification will only be sent if the same threat occurs 10 times or more within an hour.
Topics
Community Discussion
No community discussion yet for this question.