Intrusion recorded by Cisco Secure

[andy.cheung]

For record corresponding to AAA, Cisco Secure keep detail in cs_accounting_log. How about an intrusion, for example, a fail attempt to access the "telnet" prompt of a router with invalid username, password pair ?? Is the source ip address and MAC address contributing that failed attempt, recorded ? How can I find out these type of intrusion inside Cisco Secure ???

[ciscomoderator]

Since there has been no response to your post, it appears to be either too complex or too rare an issue for other forum members to assist you. If you don't get a suitable response to your post, you may wish to review our resources at the online Technical Assistance Center (http://www.cisco.com/tac) or speak with a TAC engineer. You can open a TAC case online at http://www.cisco.com/tac/caseopen

If anyone else in the forum has some advice, please reply to this thread.

Thank you for posting.