SmartEvent Corelation Questions

[Sorin_Gogean]

Hello everyone,

We're looking into enabling SmartEvent Corelation Events automatic reactions (we'll block traffic for a certain period), and we wanted to ask you, where will we see that traffic block ? Would it show up in the logs, or somewhere else?

Until now, we were generating emails from those events, and after we analyzed them, we want to take the next step .

Also we were not able to determine, how those block actions will be imposed on the gateways. Will be an block auto-created firewall rule or something else?

Thank you and have a nice week,

PS: our GW's are R80.30 and the Log and Management server is R80.40 .

[PhoneBoy]

You should see logs, but I believe they will show up as SAM rules (not in SmartConsole) on the gateway (e.g. via fw sam).

[Sorin_Gogean]

Thank you PhoneBoy, will give it a try and come back with updates.