cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
290
Views
0
Helpful
1
Replies

SSM MODULES and Mars events and local?

Patrick.Beaven
Level 1
Level 1

Is it possible to setup an AIP-SSM Module to log event alerts to Its local cache as well as the Mars Appliance. I say this because I ran some tests for alerts and never see them on the IPS module itself but i do see them on the Mars Appliance correctly! I dont know what setting would need to be changed to make sure that the event alerts are logged to the local IPS itself. Or is this even possible?

does anyone know how to make it log locally and to the MARS Appliance?

Thanks,

1 Reply 1

irisrios
Level 6
Level 6

Make sure Bypass mode is not enabled on IPs Module. Another workaround for this issue is to reload the Advanced Inspection and Prevention Security Services Module (AIP-SSM) IPS module with the hw-module module 1 reload command, and tune any noisy signatures in order to lighten the sensor load.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: