78 CHAPTER 9: USING EVENT R ULESMaintaining Network SecurityYou can configure Detect Network Sweep Attack and Detect NewDevices event rules to generate security events. There are event rules ofboth types already preconfigured. However, your firewall may be a moreappropriate source of information about attacks from outside thenetwork than Traffix Manager.Enforcing Corporate Policy About Network UsageIf you want to have specific policies about what the network is used for atdifferent times of day, you might want to consider some of thesuggestions under “Implementing Business Policies” on page 80.Monitoring Protocol UsageYou can configure a Monitor Network Trends event rule to monitor thegrowth of a specific protocol or set of protocols. For example, you mightwant to be informed if the level of Web traffic increases significantly orgoes beyond a specified threshold.Monitoring Servers Monitoring Changes in Server ActivityIf you expect the activity of your servers to be fairly constant, you canconfigure a Monitor Critical Devices event rule to tell you if the activity ofyour servers changes unexpectedly. An event rule of this type, Monitorcritical devices, is preconfigured. See “Monitor Critical Devices” onpage 74.Preventing Server CongestionYou can configure a Monitor Network Resource Usage event rule todetect if one machine seems to use an excessive amount of bandwidthon a server. A device activity report or a graph on the map can also beused to provide an immediate summary of which devices are using aserver the most. See “Device Activity Report” on page 101 andChapter 8, “Displaying Traffic in Graphs”.Monitoring Which Devices Are Using A ServerYou can track which devices are using a particular server by configuring aDetect Unauthorized Machine Access event rule for that server. When anew device starts using the server, you will be notified through an eventrule. If you wish, you can then add the device to the list of users allowedto access that particular server.
