Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

HTML reports

This may sound like a stupid question, but when I run an IDS summary report, I select High and Medium level alarms. The resulting report shows alarm levels 3 and 5, but no 4. Is there a level 4? I wouldn't normally ask a question such as this, but executive types like to ask questions like this - and unfortunately you need an answer other than "Not sure why."

2 REPLIES
New Member

Re: HTML reports

sorry forgot to mention I'm using CSPM, which may be the problem - CSPM only know HIGH, MEDIUM, and LOW, correct? Whereas the sensors use the level of alarm 1-5. Can someone validate my thinking?

Cisco Employee

Re: HTML reports

Since CSPM knows only High, Medium, Low it took the 5 levels from the sensor and changed them so High=5, Medium=3, and Low=1. If it downloaded the configuration from the sensor which had levels 2 and 4, it would change 4 to 5 so it would then be High, and changes 2 to 1 so it would then be low.

So if the sensor is configured by CSPM you will only ever see 1,3 and 5 alarms, but if hte sensor is configured manually or br the Unix Director then you could see level 2 and 4 alarms which would then be mapped to level 1 and 5 alarms.

91
Views
0
Helpful
2
Replies