Sources of Capture Engine notifications
In a Capture Engine, you must specify the source of notifications to which an action will respond. The Edit Action dialog lets you select the source for an action.
When a Source is selected, the action will be used to send (or respond to) notifications from that source, but only when the notification also has a level of severity that matches one of the levels of severity enabled for the Action in the Notifications view of the Capture Engines window. For example, you can create an Action that responds only to notifications that have Alarms as their source. If you then enable this Action only for notifications with a severity level of Severe (using the tools in the Notifications view), the Action will respond only to a notification generated by an Alarm that also has a severity level of Severe.
The sources of notifications for a Capture Engine are:
• Capture Engine: The Capture Engine is the source of notifications. It generates notifications on the occurrence of events directly related to Capture Engine functions such as the start and stop of a Capture Engine itself.
• Capture: Capture is any active capture window running on a Capture Engine. A capture window generates notifications of changes in its overall state, such as start and stop of capture, a tripped trigger, and so forth.
• Forensic Search: Forensic Search is any forensic search running on a Capture Engine.
• Alarms: Alarms are any alarms enabled in the Alarms view of any active capture window on the Capture Engine.
• Expert: Expert is the Expert view and Expert analysis functions in any active capture window on the Capture Engine.
• FTP Analysis Module: FTP Analysis Module is the analysis module running on the Capture Engine.
• Web Analysis Module: Web Analysis Module is the analysis module running on the Capture Engine.