topic Firepower Intrusion Event Alerting in Network Security

Firepower Intrusion Event Alerting

ChristopherCraddock66504 — Wed, 27 Apr 2022 14:15:43 GMT

Dear Community,

We have IPS (Inspection) enabled on several of our rules in our Access Control Policy. Eventhough we can see the intrusion events in Analysis -> Intrusions-> Events, we do not see any of these intrusion events in our syslog files. I was doing some reading and came across this article which intimates that the syslog settings are set under the intrusion policy itself:

https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/external_alerting_for_intrusion_events.html#ID-2212-00000110

However, when I look at the intrusion policy, I don't have an "Advanced option" or see anywhere I can enable syslog alerting for intrusion events.

Where do I need to go in the FMC to make sure intrusion events are sent to syslog? We are already sending Connection Events to syslog and have syslog enabled under the platform settings.

Thank you.

Re: Firepower Intrusion Event Alerting

balaji.bandi — Wed, 27 Apr 2022 16:49:59 GMT

check below :

https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Configuring_External_Alerting_for_Intrusion_Rules.html#ID-2212-000001bf

Re: Firepower Intrusion Event Alerting

ChristopherCraddock66504 — Wed, 27 Apr 2022 17:17:30 GMT

Balaji,

Thank you for the response. For the life of me I cannot find this section. Can you tell me the exact path of where to find the advanced setting? I am looking at the Advanced settings of the ACP but cannot find this option. I am also not seeing any Advanced settings in the Intrusion Policy either. Running code 7.0.1.1.

Thank you.