Packets Denied due to Global Correlation

[peter.williams]

Under the Global Correlation Reports I see Reputation Filtering 86.88% and Tranditional IPS Detection Techniques 13.12% and Global Correlation Inspection 0%. I am unable to see what the Reputation Filtering is blocking or denying, how do I see this in the reports? Also is the Traditional IPS Detection Techniques what the 6.X version was doing?

[marcabal · Accepted solution]

Right now there is not a method to see what was denied by the Reputation Filtering.

There is an enhancement request in the system to add data showing the addresses being denied by Reputation Filtering. This is being considered for a future version.

And yes the Traditional IPS Detection Techniques is what a version 6.x sensor would deny for the same traffic.

[abinjola]

hello Marco,

Do we have a PERs ID available ?

[marcabal]

I found out after my original post that I was wrong.

The report itself will not show you the addresses being denied by Reputation Filtering, however, this information IS available in the output of "show statistics analysis-engine".

There is an enhancement to create a new command for this data in a future version.

Ashish I will send you the ID for that enhancement request in a direct email.