topic Re: Thanks Marvin for the in Network Security

FireSight : How to display the list of Blocked Intrusions

guillerm — Sun, 10 Mar 2019 13:26:42 GMT

Hello,

among the numerous and useful menus/options available under FireSight (used to manage Firepower IPS embedded in ASA Firewalls), is there 1 that allows to display the list of detected intrusions that have been blocked by the Firepower ?

thanks for any feedback

Yes you can. Go to Analysis >

nspasov — Wed, 16 Sep 2015 19:38:10 GMT

Yes you can. Go to Analysis > Intrusions > Events > Edit Search. This will load a new window and in there you can see a field called "Inline Result." There you can set the result to "dropped, would have dropped, etc" You can save this search and use it later.

Thank you for rating helpful posts!

what is the difference

zakameeri — Mon, 29 Aug 2016 11:48:48 GMT

what is the difference between dropped and would have dropped?

"would have dropped" applies

Marvin Rhoads — Mon, 29 Aug 2016 13:46:16 GMT

"would have dropped" applies when a policy is monitor only (IDS) or when the module is not inline (e.g. on a span port) and thus incapable of telling the network or parent device to drop the connection.

Thanks Marvin for the

zakameeri — Tue, 30 Aug 2016 05:23:48 GMT

Thanks Marvin for the response and clarification.

Re: Thanks Marvin for the

pro_engineering — Wed, 16 May 2018 15:07:31 GMT

Just adding quick question, in my search for intrusion event i see Blank in Inline Result, like no action. What could be the reason for this? And how could i figure it out that event was dropped or passed. etc.

Thanks