Searching offenses on the By Source IP page

This topic provides the procedure for how to search offenses on the By Source IP page of the Offense tab.

About this task

The following table describes the search options that you can use to search offense data on the By Source IP page:
Table 1. By Source IP page search options
Options Description
All Offenses You can select this option to search all source IP addresses regardless of time range.
Recent You can select this option and, from this list box, select the time range that you want to search for.
Specific Interval To specify an interval to search for, you can select the Specific Interval option and then select one of the following options:
  • Start Date between - Select this check box to search source IP addresses associated with offenses that started during a certain time period. After you select this check box, use the list boxes to select the dates you want to search for.
  • Last Event/Flow between - Select this check box to search source IP addresses associated with offenses for which the last detected event occurred within a certain time period. After you select this check box, use the list boxes to select the dates you want to search for.
Search The Search icon is available in multiple panes on the search page. You can click Search when you are finished configuring the search and want to view the results.
Source IP In this field, you can type the source IPv4 or IPv6 address or CIDR range you want to search for.
Magnitude From this list box, you can specify a magnitude and then select display only offenses with a magnitude that is equal to, less than, or greater than the configured value. The range is 0 - 10.
VA Risk From this list box, you can specify a VA risk and then select display only offenses with a VA risk that is equal to, less than, or greater than the configured value. The range is 0 - 10.
Events/Flows From this list box, you can specify an event or flow count and then select display only offenses with a magnitude that is equal to, less than, or greater than the configured value.
Exclude You can select the check boxes for the offenses you want to exclude from the search results. The options include:
  • Active Offenses
  • Hidden Offenses
  • Closed Offenses
  • Inactive offenses
  • Protected Offense

Procedure

  1. Click the Offenses tab.
  2. Click By Source IP.
  3. From the Search list box, select New Search.
  4. On the Time Range pane, select an option for the time range you want to capture for this search. See Table 1.
  5. On the Search Parameters pane, define your specific search criteria. See Table 1.
  6. On the Column Definition pane, define the order in which you want to sort the results:
    1. From the first list box, select the column by which you want to sort the search results.
    2. From the second list box, select the order that you want to display for the search results. Options include Descending and Ascending.
  7. Click Search.

What to do next

Saving search criteria on the Offense tab