The Restore action enables you to restore an archived alerts and packet log files to the Manager. When restoring an archival to a target Manager, the archive must be copied to a directory on the target Manager or a network directory that Manager can access. The Restore feature also enables you to filter through the alerts in the archival.
Note
To import the file in the Manager, make sure the file size is within 1 GB.
Steps:
Select Manager → <Admin Domain Name> → Maintenance → Data Archiving → IPS → Restore Archives.
The Restore Archives page with option and Existing Archives list is displayed.
Restore Archives page.png "11_1M8-restore-archives1.png")
Do one of the following:
Click Choose File to locate the archival or enter the absolute path of the archived file and click Restore.
Select an archival listed under Existing Archives, and then click Restore.
The Restore Filter page is displayed.
Restore Filter page.png "11_1M8-restore-archives.png")
Filter alerts by the following parameters:
Severity — Select one or more severities to keep.
Result Status — Select one or more results to keep.
Start Date — Keep only the alerts and packet logs starting from the designated time.
End Date — Keep only the alerts and packet logs up to the designated time.
Click Restore.
Note
Click Restore All to restore all alerts without any filtering.
Note
Manager only permits 300,000 alerts to be restored at a time if filtering is applied. If your archive contains more than 300,000 alerts, you need to perform the restoration process multiple times. For example, if your archival still contains 750,000 alerts after filtering parameters have been met, you will have to restore three times: 1) 300,000 2) 300,000 3) 150,000.
To see the alerts restored in attack log, run solr import.
Note
To run solr import, refer to Trellix Intrusion Prevention System Installation Guide.