Modifying a filter strategy, Deleting a filter strategy, Managing anomaly detection – H3C Technologies H3C Intelligent Management Center User Manual
Page 42
33
c.
In the Source Port field, enter the source port number.
d.
In the Destination Host field, enter the destination IP address.
You can enter an IP address or an IP segment in dotted decimal notation or CIDR notation.
The format of the destination IP address is the same as that of the source IP address.
e.
In the Destination Port field, enter the destination port number.
f.
From the Protocol list, select a protocol type. Options are TCP, UDP, ICMP, and IPv6-ICMP.
g.
Click OK.
The new filter condition appears in the filter strategy list. Empty fields are ignored.
h.
Repeat the above steps to add more filter conditions.
NOTE:
Add at least one filter condition for a filter strategy. Make sure at least one of the filter conditions
you create differs in policy from the Default Policy.
5.
To modify a filter condition, click the Modify icon
for the filter condition, and modify the filter
condition in the same way the filter condition is added.
6.
To delete a filter condition, click the Delete icon for the filter condition.
7.
To re-prioritize filter conditions, click the icon in the Sort field for the filter condition you want
to move up in the list. Click the icon in the Sort field for the filter condition you want to move
down in the list.
8.
On the Add Filter Strategy page, click OK.
Modifying a filter strategy
1.
Access the Filter Strategy page.
2.
In the filter strategy list, click the Modify icon
for the filter strategy you want to modify.
The Modify Filter Strategy page appears.
3.
Modify filter strategy parameters as needed.
For more information about modifying filter strategy parameters, see "
."
4.
Click OK.
Deleting a filter strategy
1.
Access the Filter Strategy page.
2.
In the filter strategy list, click the Delete icon for the filter strategy you want to delete.
A confirm dialog box appears.
3.
Click OK.
Managing anomaly detection
UBA collects statistics on flow records and compares the statistics with the thresholds in the anomaly
detection templates. If a threshold is exceeded, UBA generates an alarm and informs the administrator
of the alarm through the IMC management module.