Threat monitor

Introduction

Threat monitor provides the rankings of threats detected in the most recent monitoring interval by different ranking criteria. Both IPS events and anti-virus events are classified as threats.

Threat monitor provides the following widgets:

·     Threat monitor user ranking.

·     Threat monitor application ranking.

·     Attacker ranking.

·     Attacked target ranking.

·     Threat type ranking.

·     Threat name ranking.

·     Threats overview. Support for this widget depends on the device model.

To customize the widgets displayed on the Threat Monitor page, click Select widgets and select the desired widgets from the list.

To enable automatic refresh for a widget:

1.     Click the Set icon  in the top-right corner of the widget.

2.     Select the Auto refresh option.

3.     Enter the refresh interval in the Refresh interval field.

4.     Click OK.

Threat monitor user ranking widget

This widget ranks users by the number of times they are attacked by threats, which helps administrators customize policies to protect vulnerable users.

Threat monitor application ranking widget

This widget ranks applications carrying viruses by the number of times they poses threats to the network, which helps administrators customize security policies to improve security.

Attacker ranking widget

This widget ranks attackers by the number of threat attacks they launched, which helps administrators customize security policies targeted at the attackers to improve security.

Attacked target ranking widget

This widget ranks attacked targets by the number of times they are attacked, which helps administrators customize security policies to protect targets vulnerable to attacks.

Threat type ranking widget

This widget ranks types of threats by threat count, which helps administrators customize security policies to address the most common types of threats to improve security.

Threat name ranking widget

This widget ranks threats by threat count, which helps administrators customize security policies to address the most common threats to improve security.

Threats overview widget

This widget displays the security status of the internal network over the past hour.

By analyzing the distribution of threats by severity level, the device determines the security score and the risk level for the internal network. A higher security score indicates a lower risk level. The security scores and their corresponding risk levels are as follows:

·     A security score in the range of 0 to 50 corresponds to high risk level.

·     A security score in the range of 50 to 70 corresponds to medium risk level.

·     A security score in the range of 70 to 90 corresponds to low risk level.

·     A security score in the range of 90 to 100 corresponds to secure risk level.