Manage source names

Use source names to quickly identify non-threatening internal traffic and testing while monitoring attack events in your organization.

You can label one or more IP addresses and subnet masks with a source name of your choice. When the source name is saved, you can see the name (rather than user IP information) by selecting Attacks > Monitor or looking on the Attacks Details page, making it easier to identify the named attacker as a known source when assessing attack events.

To create source names:

  1. Go to User menu > Policy Management > IP Management > Source Names.

  2. Click Add Source Name.

  3. Enter the Name by which you want to identify one or more IP addresses.

  4. Add the IP Address/Subnet Mask to identify by this source name. Use the link to Add more IP addresses or subnet masks to the group, if necessary.

  5. Use the dropdown menus to select the Start and End dates and times for the source name. You may choose to create a custom time span that starts on a past date; in this case, the source name applies retroactively to any attack events.

  6. Once the fields are completed, click Add to save the source name.

Once a source name is added in your organization, the source name appears for attacks that match the criteria on the Monitor and Attack details pages.

If the data reported for an attack event matches more than one source name, Contrast applies the name that you updated most recently.

For more information about using source names to view attackers and attack events, see Monitor attacks.

Edit a source name

To edit a source name, complete the following steps.

  1. Click the source name in the Source Names grid.

  2. Use the Edit Source Name form to update the necessary fields.

  3. Click Save.

Delete a source name

To delete a source name, click on the trashcan icon below the Edit Source Name form. You can also select the trashcan icon in the Source Names grid.

Once the name is deleted, all references to the name are replaced with the IP information.