MARS 6.0.4 reporting for IPS 7.0 Global Correlation Reputation Filtering

MARK BAKER · ‎08-27-2009

Does anyone know if there is a report available in MARS to see what IP addresses were denied by Reputation Filtering on IPS 7.0?

I found a report that shows attacks that were prevented due to global correlation score, but not for packets denied by Reputation Filtering.

Replies are greatly appreciated.

Thanks,

Mark

gmarogi · ‎09-02-2009

If you want a report of what could have happened, you can enable Test Global Correlation. This puts the sensor in Audit mode, and actions the sensor would have performed are generated in the events.

MARK BAKER · ‎09-02-2009

Thanks for the reply, but what I am looking for is reporting on what packets were dropped with Reputation Filtering(doesn't have a report in MARS) Not the GLobal Correlation risk rating blocks(Which does have a report available in MARS).