H3C Technologies H3C Intelligent Management Center - Manual (Page 959)

945
b. Click the Security Control Center on the navigation tree on the left.
c. Click the Alarm Matching Policy link located under Security Control Center on the navigation
tree on the left.
The Alarm Matching Policy List appears in the main pane of the Security Control Policy page.
2. Click the Modify icon for the alarm matching policy you want to modify.
The Modify Alarm Matching Policy page appears.
You cannot modify the policy name.
3. Enter a new description for the alarm matching policy in the Policy Description field.
4. Re-select an alarm for the alarm matching policy:
a. Click Select Alarm to the right of the Alarm Name field.
The Select Alarm window appears.
b. Filter alarms by the following criteria:
{
Trap Name: Enter a partial or complete name for the trap. For example, to query for a trap
definition with the name, alarmFeBlock, enter alarmFeBlock in the Trap Name field.
{
Enterprise Name: Enter partial or complete name for the vendor whose MIB contains the trap
you want to query for. For example, to query for all 3Com traps, enter 3Com in the Enterprise
Name field.
{
Trap OID: Enter partial or complete Object ID for the trap in which you want to query. For
example, the object ID for alarmFeBlock is 1.3.6.1.4.1.43.1.12.3.6.155. Enter
1.3.6.1.4.1.43.1.12.3.6.155 in the Trap OID field to retrieve traps with this Object ID.
{
Enterprise ID: Enter partial or complete Enterprise ID for the vendor whose MIB contains the trap
in which you want to query. For example, the Enterprise ID for 3Com is 1.3.6.1.4.1.43.1.12.3.
Enter 1.3.6.1.4.1.43.1.12.3 to retrieve all traps by 3Com from the trap definition list.
c. Click Query.
The results of the query are displayed in the alarm list portion of the page.
d. Click Reset when you have finished your search to restore the full alarm list.
e. Select an alarm.
f. Click OK.
The name and OID of the selected alarm appear in the Alarm Name field.
5. Modify the alarm variable matching rules for the alarm matching policy:
a. Click Add Rule in the Alarm Variable Matching Rule List.
The Add Rule window appears.
b. Select an alarm variable from the Alarm Variable Name list.
c. Enter a regular expression in the Regular Expression field.
d. Click OK.
The new alarm variable matching rule appears in the Alarm Variable Matching Rule List.
e. Repeat the previous steps to add more rules.
f. To delete one or more rules, click Delete for the associated rules.
6. Configure the attack location options in the Action/Alarm Variable Mappings area:
{
Locate Attack Source: Select this option to enable SCC to locate the attack source for the alarm.
{
Locate Attack Destination: Select this option to enable SCC to locate the attack destination for
the alarm.