User's Guide

wherever the feature is implemented. Synchronizing Accounts has a good example of how the
synchronization feature works.)
Note
You must have a Central Management license in order to use the Check Synchronization
feature.
Anomalous Behavior Alarms
Behavior Alarms track atypical device behavior based on a long term forensic baseline of devices at that
site. AirDefense utilizes the Forensic Datastore to monitor and store over 325 wireless statistics for each
device on a minute-by-minute basis. Statistical analysis is performed over 2 weeks of this historical data
to create a baseline of activity for devices. Events are generated when a device operates outside of its
normal behavior to alert the administrator of anomalous or suspicious behavior.
For example, consider a user device that has a wireless usage behavior baseline of basic web and email
access. A behavior event would be raised if this user then suddenly downloads significant amount of
data after business hours, a time period when the station is not normally active. This anomalous
behavior could be indicative of a stolen or spoofed identity, or disgruntled employee that may be
downloading significant amounts of confidential and/or proprietary information. Behavior Alarms are
broken down into the following two sub-types:
• BSS Abnormal Activity - Anomalous behavior events specific to BSSs.
• Wireless Client Abnormal Behavior - Anomalous behavior events specific to Wireless Clients.
Alarm Library
To view a list of Behavior Alarms for each alarm sub-type, go to Configuration > Operational
Management > Alarm Configuration, open Anomalous Behavior, and then open the alarm sub-type to
see all the alarms associated with the sub-type.
Bluetooth Alarms
Bluetooth alarms provide 24x7 monitoring of Bluetooth devices in your network. The system can
automatically detect security threats from unsanctioned Bluetooth devices and proactively notify
administrators about the presence of these threats. The Bluetooth alarm sub-type is Bluetooth Devices:
• Rogue Bluetooth Device
• Rogue Bluetooth Device Out of Hours
• Unsanctioned Bluetooth Device
Alarm Library
To view a list of Bluetooth Alarms for each alarm sub-type, go to Configuration > Operational
Management > Alarm Configuration, open Bluetooth, and then open the alarm sub-type to see all the
alarms associated with the sub-type.
Exploits Alarms
Exploits are events in which a user is actively interacting with the wireless network or wireless medium.
By exploiting wireless vulnerabilities a malicious user could cause wireless network disruptions or use
the wireless medium to gain access to corporate resources and confidential data. The vulnerabilities
may exists due to network configuration, corporate policy, or an inherent flaw in the 802.11 protocol. A
Operational Management
Legacy Content
1156 Extreme AirDefense User Guide for version 10.5.