User's Guide

AirDefense Alarm Model
Suppressed Alarm Repetition
AirDefense has made significant advancements in the Alarm Model, dramatically decreasing the
occurrence of repetitious alarms. In the new Alarm Model, the AirDefense appliance leverages the
extensive data it collects about security events to determine whether events are:
• Unique events
• Repeat occurrences of activities that constitute a single security event
• Repeat observances of a single, ongoing event.
Based on this distinction, AirDefense is able to display alarms for unique events and suppress repetitive
alarms for ongoing events. This provides better correlation between individual security events and
individual alarms.
How an Alarm is Generated
Violations are reported internally to the appliance every minute as events.
The AirDefense wireless security research team maintains algorithms for correlating observed security
events, to identify when a predefined high water mark for the event is reached. The high water mark, in
its simplest terms, is a number of identical events that occur within a specific period of time. When the
high water mark is reached, it triggers an alarm on the GUI.
Example-Generated Alarm
Three XYZ events within a 30-minute period defines the high-water mark for XYZ events. If the
appliance detects three or more such events within any 30-minute period, an alarm is triggered.
Alarms
AirDefense Alarm Model
Extreme AirDefense User Guide for version 10.5. 479