Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

Can you read a dropped event?

I had a mis-configured drop rule that logged to the DB.

Is it possible to go back and review the event in the DB to get the info from the attack?

1 ACCEPTED SOLUTION

Accepted Solutions
Community Member

Re: Can you read a dropped event?

With the risk of telling you something you already know...events "logged to DB" are excluded from the incident process but processed when creating reports, so one solution in this case would be to set up a raw data report to see what exactly was logged.

/Fredrik

2 REPLIES
Community Member

Re: Can you read a dropped event?

With the risk of telling you something you already know...events "logged to DB" are excluded from the incident process but processed when creating reports, so one solution in this case would be to set up a raw data report to see what exactly was logged.

/Fredrik

Community Member

Re: Can you read a dropped event?

You and I had similar ideas. I pulled the raw logs and it was able to answer my questions.

Sorry it was late in the day or I would have replied earlier.

172
Views
0
Helpful
2
Replies
CreatePlease to create content