NetIQ Documentation: NetIQ Sentinel 7.0.1 Administration Guide - Viewing the Advisor Data

11.8 Viewing the Advisor Data

Make sure you have completed the following prerequisites to view the Advisor data:

The Advisor feed must be up-to-date, processed, and loaded into the Sentinel database.
The selected event is from a product supported by Advisor and has the Vulnerability field value set to 1.

You can view the Advisor data from the following options:

11.8.1 Active Views

In the Sentinel Control Center, click Active Views.
In the real-time events table, right-click an event that has the Vulnerability field value set to 1.
Click Analyze > Advisor Data.

11.8.2 Search results in the Web Interface

In the Sentinel Web interface, click Filters > Exploit Detected Events or specify vul:1 in the Search field, then click Search.

All events that are likely to have exploited a known vulnerability are displayed.

You can also view the report for these events by selecting the desired events, then clicking Event Operations > View Advisor report.