Tuning and Customization: NBA technologies rely primarily
on observing network traffic and developing baselines of
expected flows and inventories of host characteristics. NBA
products automatically update their baselines on an ongoing
basis. As a result, typically there is not much tuning or
customization to be done, other than updating firewall rule set like
policies that are offered by most products. Also,
administrators might adjust thresholds periodically (e.g., how
much additional bandwidth usage should trigger an alert) to take
into account changes to the environment. Thresholds can often
be set on a per-host basis or for administrator-defined groups of
hosts. Most NBA products also offer white list and blacklist
capabilities for hosts and services. Another common feature of
NBA products is customization of each alert (e.g., specifying
which prevention option it should trigger). Unlike networkbased
IDPSs, code editing features are generally not applicable
to NBA products.
Tuning and Customization: NBA technologies rely primarilyon observing network traffic and developing baselines ofexpected flows and inventories of host characteristics. NBAproducts automatically update their baselines on an ongoingbasis. As a result, typically there is not much tuning orcustomization to be done, other than updating firewall rule set likepolicies that are offered by most products. Also,administrators might adjust thresholds periodically (e.g., howmuch additional bandwidth usage should trigger an alert) to takeinto account changes to the environment. Thresholds can oftenbe set on a per-host basis or for administrator-defined groups ofhosts. Most NBA products also offer white list and blacklistcapabilities for hosts and services. Another common feature ofNBA products is customization of each alert (e.g., specifyingwhich prevention option it should trigger). Unlike networkbasedIDPSs, code editing features are generally not applicableto NBA products.
การแปล กรุณารอสักครู่..
