ASA threat-detection details

mark.j.hodge · ‎07-20-2009

I have basic threat detection turned on on a 5520 running 8.0(4) software. This is showing a number of "scanning" attacks. From the "sh threat-detection scanning-threat" command I can see the Targets and Attackers, but I would like more details. In particular I would like to know,

A - The targets attacked by a specific device.

B - The activity an attacker performed to put it on the list, i.e. port scan or IP scan.

Is this possible?

robertson.michael · ‎07-23-2009

Hi Mark,

Try 'show threat-detection statistics top tcp-intercept'. That may give you at least some of the information you're looking for.

'show threat-detection statistics top' Command Reference:

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/s7.html#wp1259987

Hope that helps.

-Mike