A good reference point for determining your required database capacity based on the volume of alerts and packet logs is to find the average alert rate for a week, then multiply by a longer time frame such as 12 weeks, one year (52 weeks), and so forth. To do this, generate an Executive Summary Report using a one-week time horizon.
Steps:
Click Analysis → Event Reporting → Traditional Reports.
From the IPS Events list, select Executive Summary. The Configure Executive Summary Report page is displayed.
Fill in the following fields to determine the average weekly alert rate:
Admin Domain— Select the root admin domain (default).
Sensor— Select All Devices (default if you have more than one Sensor).
Attack Severity— Make sure all three severities (Low, Medium, High) are checked. When all three are selected, Informational alerts are also included.
Alert State— Select View All Alerts. Both acknowledged and unacknowledged alerts are included for the specified time frame.
Attacks— Choose Select Attacks in the past: 1 Week(s). You do not need to adjust the "Ending" time fields.
Get summary of— You do not have to adjust this field.
Report Format— Select a view of the report information from the following: HTML, PDF and Save as CSV.
Click Run Report once all of the above fields are set.
This report displays your alert data in a presentation-style format (that is, tables and colored pie charts). The first pie chart details the "Total Alerts Per Sensor." Simply add the totals from each Sensor to determine the amount for one week.