topic Re: No Intrusion Events populating in the FMC in Network Security

No Intrusion Events populating in the FMC

iolide — Fri, 21 Feb 2020 17:15:09 GMT

Hello,

I've recently come across an issue where there are no Intrusion Events being populated in the FMC. The last Intrusion event log was about 10 days ago, but now there is "No Data" under Overview -> Intrusion and when I go to Analysis -> Intrusion -> Events; there are no events being shown.

Nothing has changed configuration wise, but the FMC was upgraded to 6.4.0 while the sensors are running on 6.1.0/6.2.0.

Any Ideas or suggestions?

Thanks for help.

Re: No Intrusion Events populating in the FMC

nspasov — Mon, 01 Jul 2019 03:54:37 GMT

A couple of things to check:

Is the device enabled with IPS license

Do you have an IPS policy applied to an Access Control Policy

Is logging enabled for the IPS events

Generate some IPS events manually and check again. It is perhaps possible that there has not been any intrusions in the time window that you are checking for 🙂

Thank you for rating helpful posts!

Re: No Intrusion Events populating in the FMC

iolide — Mon, 01 Jul 2019 14:09:51 GMT

Thanks for the reply nspasov.

To answer the questions; we do have IPS license as well as a few intrusion policies applied to the Access Control Policies configured. Everything on the configuration side appears to be set and working; it's just that the intrusion events stopped suddenly on the 18th. I am not sure if it is because we have Variable Sets defined with networks? Or if this is due to the FMC running on 6.4.0 while the sensors are running on 6.1.0/6.2.0.

Also, what is the best way to generate some manual IPS events to check on this?

I am fairly new to the Sourcefires, so I REALLY appreciate the feedback/assistance.

Thank you!

Re: No Intrusion Events populating in the FMC

nspasov — Sat, 06 Jul 2019 05:34:02 GMT

It is possible that you are hitting a defect associated with version 6.4. However, I just tested this in my lab and I am definitely seeing intrusion events in my event viewer. What patch level are you running? I tested this while running with patch-1. Patch-2 just got released and it resolves a good amount of defects.

With regards to generating IPS events. I use the wonderful and free version of Qualys Community Edition:

https://www.qualys.com/community-edition/

You can scan a few IPs for free and if you find it useful, you can always get the paid version.

I hope this helps!

Thank you for rating helpful posts!

Re: No Intrusion Events populating in the FMC

drivera_ — Wed, 21 Aug 2019 04:11:41 GMT

Hi, iolide

Did you find a solution for this? I'm having the same issue. When trying to see if there is some intrusion events, we don't see anything. I attached the screenshoot I took.

We have already configured an IPS policy and apply it to an Access Control Rule too. I've been watching videos and reading many documenation, but I haven't found the solution yet.

Re: No Intrusion Events populating in the FMC

AlexDaly34553 — Mon, 14 Oct 2019 13:48:08 GMT

Same issue for me here since 6.4.0 upgrade, but only on one of the HA FMC? Swapping to secondary has intrusion events.

Re: No Intrusion Events populating in the FMC

AlexDaly34553 — Tue, 05 Nov 2019 10:37:03 GMT

In my environment the firings last about 2 hours and then stop.

Re: No Intrusion Events populating in the FMC

Crizz — Wed, 07 Jul 2021 19:32:25 GMT

Hi, iolide.

Did you find a solution for this? I'm having the same issue.

Thank you.

Re: No Intrusion Events populating in the FMC

srkraju8281 — Wed, 19 Oct 2022 11:10:59 GMT

did u find any solution for this , iam still having issue

Re: No Intrusion Events populating in the FMC

srkraju8281 — Wed, 19 Oct 2022 11:14:21 GMT

i too have same issue after reboot on only one of the HA pair, did u find any resolution ?

Re: No Intrusion Events populating in the FMC

Marvin Rhoads — Wed, 19 Oct 2022 15:16:15 GMT

This can be caused by the following bug: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwb59619

If you are hitting that, a reboot will clear it.

Re: No Intrusion Events populating in the FMC

seckka21 — Wed, 04 Jan 2023 16:35:46 GMT

did you find solution , i am having the same issue.

Thanks in advace