topic hiI'm not quite following in Network Security

botfilter real-time report in ASDM

nikolaj joeker — Tue, 12 Mar 2019 05:53:34 GMT

I have botfilter installed and running on an ASA5520 sw 9.1(5) ASDM 7.3(3).

The filter is active an detecting and blocking.

The Statistics in ASDM Monitoring is showing detections and blockings, the Infected Hosts is showing detections by host as expected.

But the real-time report in Monitoring in ASDM dosn't show anything.

Ány suggestions how to solve that?

regards Nikolaj

Vibhor Amrodia — Wed, 06 May 2015 10:57:04 GMT

Hi,

Have you tried to check for these specific Syslog ID in the ASDM monitoring :-

338001 - 338004

338101 - 338104

338201 - 338204

338301 - 338310

Refer:-

http://www.cisco.com/c/en/us/td/docs/security/asa/syslog-guide/syslogs/logmsgs1.html#pgfId-5787165

Thanks and Regards,

Vibhor Amrodia

nikolaj joeker — Wed, 13 May 2015 08:03:16 GMT

I'm not quite following.

These ID's seems to notify detections etc regarding the BOT filter.

The ASA is detecting the BOT traffic and blocking and allowing.

My problem is that the ADSM doesn't update the "real-time report" in the ASDM interface.

Vibhor Amrodia — Thu, 14 May 2015 04:49:08 GMT

Hi,

I am sorry. I misunderstood your question.

Upgrade to ASDM 7.4.1 and above to fix this Defect:-CSCuq59377

https://tools.cisco.com/bugsearch/bug/CSCuq59377/?reffering_site=dumpcr

Thanks and Regards,

Vibhor Amrodia