topic Internal Auditor asking for IPS Report in Network Security https://community.cisco.com/t5/network-security/internal-auditor-asking-for-ips-report/m-p/2062988#M54599 <HTML><HEAD></HEAD><BODY><P>Jeff,</P><P></P><P>The other signatures have "Produce Alert" as one of its actions?</P><P></P><P>Luis Silva</P></BODY></HTML> Fri, 28 Sep 2012 03:52:37 GMT Luis Silva Benavides 2012-09-28T03:52:37Z Internal Auditor asking for IPS Report https://community.cisco.com/t5/network-security/internal-auditor-asking-for-ips-report/m-p/2062985#M54594 <P>Our Internal Auditor is asking for a copy of the logs or a report from our IPS showing that it is indeed keeping bad guys out.&nbsp; If you have had this same request, what info have you provided?</P> Sun, 10 Mar 2019 12:47:19 GMT https://community.cisco.com/t5/network-security/internal-auditor-asking-for-ips-report/m-p/2062985#M54594 doug.dockter 2019-03-10T12:47:19Z Internal Auditor asking for IPS Report https://community.cisco.com/t5/network-security/internal-auditor-asking-for-ips-report/m-p/2062986#M54595 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P></P><P>You may provide the list of signatures that have fired.</P><P>From CLI issue, "show stats virtual-sensor | inc Sig", this will give you the list of all signatures that fired.</P><P></P><P></P><P>Regards,</P><P>Sawan Gupta</P></BODY></HTML> Wed, 26 Sep 2012 05:06:40 GMT https://community.cisco.com/t5/network-security/internal-auditor-asking-for-ips-report/m-p/2062986#M54595 sawgupta 2012-09-26T05:06:40Z Internal Auditor asking for IPS Report https://community.cisco.com/t5/network-security/internal-auditor-asking-for-ips-report/m-p/2062987#M54597 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P></P><P>I ran this command on a recently enabled AIP-SSM-10 module and it reports several signatures have fired.&nbsp; However, when I run a report or check the event monitor in IME all I see are events for the NetBIOS 5575/0 signature and the ICMP signatures (2000.0 and 2004.0) that I enabled for testing purposes.&nbsp; Any idea why the other signatures do not appear in my report?</P><P></P><P>show statistics virtual-sensor | inc Sig</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Name of current Signature-Defintion instance = sig0</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The Signature Database Statistics.</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SigEvent Preliminary Stage Statistics</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Number of Active SigEventDataNodes&nbsp; = 26</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Per-Signature SigEvent count since reset</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Sig 2000.0 = 73</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Sig 2004.0 = 122</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Sig 3653.0 = 40468</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Sig 5575.0 = 669</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Sig 6131.6 = 788554</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Sig 6250.1 = 2504</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Sig 16297.0 = 29</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Sig 21619.1 = 5299</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Sig 23782.2 = 17</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SigEvent Action Override Stage Statistics</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SigEvent Action Filter Stage Statistics</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SigEvent Action Handling Stage Statistics.</P><P></P><P>Thanks,</P><P>Jeff</P></BODY></HTML> Thu, 27 Sep 2012 13:25:22 GMT https://community.cisco.com/t5/network-security/internal-auditor-asking-for-ips-report/m-p/2062987#M54597 jmadill-intellimec 2012-09-27T13:25:22Z Internal Auditor asking for IPS Report https://community.cisco.com/t5/network-security/internal-auditor-asking-for-ips-report/m-p/2062988#M54599 <HTML><HEAD></HEAD><BODY><P>Jeff,</P><P></P><P>The other signatures have "Produce Alert" as one of its actions?</P><P></P><P>Luis Silva</P></BODY></HTML> Fri, 28 Sep 2012 03:52:37 GMT https://community.cisco.com/t5/network-security/internal-auditor-asking-for-ips-report/m-p/2062988#M54599 Luis Silva Benavides 2012-09-28T03:52:37Z Internal Auditor asking for IPS Report https://community.cisco.com/t5/network-security/internal-auditor-asking-for-ips-report/m-p/2062989#M54601 <HTML><HEAD></HEAD><BODY><P>Luis,</P><P></P><P>Thanks for the reply.&nbsp; You are correct they are not set to alert and that is why I am not seeing anything in the event monitor or reports.&nbsp; Thanks again for the response!</P><P></P><P>Jeff</P></BODY></HTML> Fri, 28 Sep 2012 12:34:30 GMT https://community.cisco.com/t5/network-security/internal-auditor-asking-for-ips-report/m-p/2062989#M54601 jmadill-intellimec 2012-09-28T12:34:30Z Internal Auditor asking for IPS Report https://community.cisco.com/t5/network-security/internal-auditor-asking-for-ips-report/m-p/2062990#M54604 <HTML><HEAD></HEAD><BODY><P>You are welcome! </P><P></P><P>Luis Silva</P></BODY></HTML> Sun, 30 Sep 2012 16:20:21 GMT https://community.cisco.com/t5/network-security/internal-auditor-asking-for-ips-report/m-p/2062990#M54604 Luis Silva Benavides 2012-09-30T16:20:21Z