This ability to raise flags and perform selective actions based on the state of those flags is known as Event Context Capturing, and provides the ability for ITA to distinguish between different events of the same type, perhaps sorting out five failed administrator logins out of the thirty failed logins that occurred in the last minute. Finally, the action clause provides the means for ITA to act on what it considers to be a positive alert. Any number of rules and clauses can be combined to make a Policy, and rules can even be chained together, subsequent rules depending on the output of preceding ones. This makes Intruder Alert one of the most flexible scanners we have seen to date. The Manager branch lists previously connected Managers, and the ITA Administrator allows you to connect to multiple Managers at the same time.
Hosts can belong to more than one domain if required.
Once a Policy has been placed in the Policy folder of a particular Manager, it can be quickly deployed to every Agent in one or more Domains by right clicking on the Policy and selecting the Domains to which you want to deploy it. Once a Policy has been applied to a Domain, it is automatically deployed to all the Agents within that Domain and monitoring begins immediately. At any point, it is a simple matter to expand the tree hierarchy and see which Agents are in which Domains, and which Policies apply to which Domains. The Shared Actions Policy provides a number of Actions which can be used from within any Policy on the system, allowing all actions to be administered from a central location. The ITA Event Viewer Bandwidth is always an issue in a distributed hierarchy such as that employed by ITA, where multiple Agents have to communicate with Managers, and Managers have to communicate with central consoles.