I wish ISA had better real-time monitoring tools that can tell me how the flow of information is going through, where it is going and who sent it. Of course a lot can be read from the logs but it usualy takes a lot of time tracking who did what.
That would be nice! There are even some tricks they could easily implement that would allow you to view the log files in real time, which would be an improvement.
Real time Monitoring would be Excellent. Especially if they had a Button to click on that would add the destination address to a file for blocking. No more manually typing things in, to many mistakes can be made that way.
i'll 2nd this request.. maybe something like you see on fw-1, a gui monitor that shows exactly what sessions are happening & what's going on in each one.