cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
398
Views
0
Helpful
2
Replies

Attack Relevancy Rating

k.dmowski
Level 1
Level 1

What is the internal value of the Attack Relevancy Rating for the system with relevance=not-relevant. I do not see any difference for the system with relevance=unknown. In the attachment you will find the example of an attack? It is OK or not?

Looking forward ho hearing from you

2 Replies 2

mkodali
Cisco Employee
Cisco Employee

value for ARR is adjusted as below :

- Unknown relevance : no change

- Relevant : +10

- Not-Relevant : -10 for promiscuous mode and no change for inline mode.

From the above adjustments sensor is behaving as it is supposed to be in your case. Since the risk ratings are same for system with not-relevant and unknown OS, looks like your sensor is in inline mode.

Hi

Thank you very much for your information

Best regards

Kazimierz

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: