topic Global Correlation and Anomaly detection drop messages? in Network Security

Global Correlation and Anomaly detection drop messages?

dschwind — Sun, 10 Mar 2019 12:38:27 GMT

We've implemented an SSP-40 and were wondering if there were event messages for Global Correlation or Anomaly detection drops. We seem to only have signature event messages.

Dennis

Global Correlation and Anomaly detection drop messages?

sawgupta — Tue, 27 Mar 2012 01:50:03 GMT

Please have a look at the following link:

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/idm/idm_collaboration.html#wp1065809

If the traffic dropped becuase of Global Correlation, (and not becuase of a signature) you should see an event.

For more details you can use the "show statistics global-correlation" CLI.

For Anomaly Detection, please ensure you have "Produce Alert" event action configured.

Regards,

Sawan Gupta

Global Correlation and Anomaly detection drop messages?

dschwind — Tue, 27 Mar 2012 13:27:59 GMT

Can you provide an example message for either type? The output for "show statistics global-correlation" isn't very detailed. I will double check the setting for Anomaly Detection to make sure an alert is being produced.

We don't know what to look for when searching for the specific message types.

Thanks,

Dennis

Global Correlation and Anomaly detection drop messages?

sawgupta — Tue, 27 Mar 2012 15:22:29 GMT

Sure. Here is an example:

evIdsAlert: eventId=1332748411090083862 severity=informational vendor=Cisco alarmTraits=32768

originator:

hostId: sensorName

appName: sensorApp

appInstanceId: 19247

time: 2012/03/27 15:12:41 2012/03/27 15:12:41 UTC

signature: description=ICMP Echo Request id=2004 created=20001127 type=other version=S592

subsigId: 0

interfaceGroup: vs0

vlan: 1104

participants:

attacker:

addr: locality=OUT A.B.C.3

target:

addr: locality=OUT A.B.C.2

os: idSource=unknown relevance=relevant type=unknown

actions:

deniedPacket: true

riskRatingValue: attackRelevanceRating=relevant targetValueRating=medium 95

threatRatingValue: 60

interface: ge2_0

protocol: icmp

globalCorrelation:

globalCorrelationScore: -9.2

globalCorrelationRiskDelta: 60

globalCorrelationModifiedRiskRating: true

globalCorrelationDenyPacket: true

globalCorrelationDenyAttacker: false

globalCorrelationOtherOverrides: false

globalCorrelationAuditMode: false

Alternatively, you can see the stats using:

sensor# show  statistics analysis-engine | be Malicious
MaliciousSiteDenyHitCounts
A.B.C.D/16 = 1
MaliciousSiteDenyHitCountsAUDIT

Regards,

Sawan Gupta