H3C Technologies H3C Intelligent Management Center - Manual (Page 26)

12
• Flow Monitor Abnormal for IMC UAM
• Flow Monitor Serious for IMC UAM
• SecCenter
Once IMC has detected and escalated a security event to an alarm, it is displayed in one of the two
tabular views, the Attack Alarm List and the Real Time Attack Alarm List for security attack alarms. SCC
also provides operators with a visual display of attacks through the attack path topology map.
Operators can respond to attack alarms by initiating any of the following actions:
• Shutting down an interface.
• Sending an email.
• Sending a message to the online user.
• Kicking the online user off.
• Adding the online user to the blacklist.
SCC also provides integration with the IMC EAD component that enables SCC to receive security events
from IPS and other security aware devices in the network. It can turn those events into actions, such as
isolating or blocking endpoints to protect network assets.
Through the use of security control policies, operators can proactively manage their response to security
threats and attacks. Service control policies allow operators to define what actions are taken in response
to attack alarms.
A security control policy combines the identification and alarming of a security attack with an action that
can be taken in response to the security attack. The actions configured for security control policies can be
executed manually or they can be configured to run automatically upon detection of the security attack.
Like many IMC modules, SCC also provides operators with summarized reporting of security attacks in
the last hour. Summary reports include:
• Top 10 Attack Alarms Report
• Top 10 Attack Sources Report
• Top 10 Attack Destinations Report
• Execution Results Report
SCC can be integrated with the SMS. Open the SMS management page in SCC to view information
about security devices managed by the SMS.
Through the SMS, SCC integrates the monitoring functions for security devices in the entire network.
Global VLAN management
With IMC, VLANs can be managed globally or on a per device basis. The IMC Global VLAN option
gives operators the ability to create standardized VLANs across all devices in the infrastructure that
support VLANs. They can create VLANs, and then add, configure, or remove them from all devices that
support this feature.
IMC also employs the batch operation concept to VLAN management. It does this by enabling operators
to create and configure VLANs on one or more devices. This includes configuring access, trunk, or hybrid
ports using the batch feature for VLAN management.
For individual device VLAN management, operators can select devices for configuring VLANs. From the
same interface, they can also configure virtual interfaces, access ports, trunk ports, or hybrid ports for
each VLAN.