Common Configuration Options

A detection method can be used as a base for individual method instances. Each instance represents specific settings of the detection method and it should be connected to some data feeds. Settings of detection methods consist of two types of action – actions performed collectively on the whole group of instances and actions performed on single method instances.

Actions for a group of instances

• Instance group activation or deactivation: each method, except for the system methods, can be activated or deactivated.

Actions for single-method instances

• Delete method instance: it removes the given method instance (Delete instance).

• Perform method actions: some methods allow you to call actions that are related to the given method. The list of available actions for a particular method can be found after clicking Perform method actions. The most common action is Reset. This action terminates all the active events detected by the selected method instance. If a detection method needs classifiers for performing the detection, this action resets them. There are also some actions specific to the particular methods whose descriptions can be found in the user interface, under the action name.

• Activate/Deactivate method instance: activates or deactivates the given method instance (Start/Stop button).

• Edit method instance: allows you to configure the given method instance (Edit instance).

• Setting the time to store outputs: it sets the time period during which the outputs of the detection method stored in the system (set DeleteEventsAfter parameter). This configuration option can be also found in the Data storage settings where it is possible to set the global value for all methods' instances.

• Parameter DeactivatedSubmethods: for detection methods that have two or more submethods (except the BPATTERNS method), the DeactivatedSubmethods parameter can be set. This parameter is used to disable unwanted submethods. Selected submethods are excluded from detections.

• Assigning filters to the method instance: most methods may be restricted in terms of processed traffic by assigning filters to them (Filters in the method configuration).

• Copying of a method instance: it is possible to make a copy of any existing method instance (Copy instance).

• Reset method instance: it sets the given method instance to default settings according to the method template (Reset to default).

• Adding a new method instance: it creates a new method instance with configuration based on the method configuration template. It is necessary to assign the instance of a method to some data feeds (New instance).