Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

Bronze

MARS 6.0.4 reporting for IPS 7.0 Global Correlation Reputation Filtering

Does anyone know if there is a report available in MARS to see what IP addresses were denied by Reputation Filtering on IPS 7.0?

I found a report that shows attacks that were prevented due to global correlation score, but not for packets denied by Reputation Filtering.

Replies are greatly appreciated.

Thanks,

Mark

2 REPLIES
Bronze

Re: MARS 6.0.4 reporting for IPS 7.0 Global Correlation Reputati

If you want a report of what could have happened, you can enable Test Global Correlation. This puts the sensor in Audit mode, and actions the sensor would have performed are generated in the events.

Bronze

Re: MARS 6.0.4 reporting for IPS 7.0 Global Correlation Reputati

Thanks for the reply, but what I am looking for is reporting on what packets were dropped with Reputation Filtering(doesn't have a report in MARS) Not the GLobal Correlation risk rating blocks(Which does have a report available in MARS).

204
Views
0
Helpful
2
Replies