topic cisco IPS reporting in Network Security

cisco IPS reporting

seegomaa — Sun, 10 Mar 2019 12:31:09 GMT

Hi All,

When i genrate top 10 victim report on IPS module on ASA 5520 it shows that attacker addresses are my local LAN ip addresses and the victims are public ip address on the internet. I beleive should be the other way around to be the victim are my LAN side.

I have the same in more than on IPS modules for different customers

Please advise

cisco IPS reporting

rhermes — Tue, 18 Oct 2011 18:14:58 GMT

Have you been performing any analysis on these "attacks"? Are they real or false positives?

If they are real and your attackers and victims are indeed incorrect, you can swap them by editing the signature in question.

- Bob

cisco IPS reporting

seegomaa — Wed, 19 Oct 2011 03:44:53 GMT

thanks Bob for your reply.

I believe that it is incorrect because all attackers are from LAN side and zero from outside for around 4 months.

So could you explain to me how to swap this in the signature as you mentioned ? ""Im using GUI interface""

Thanks,,,

cisco IPS reporting

rhermes — Wed, 19 Oct 2011 15:44:40 GMT

Using the Java GUI,

Go into the "Configuration" tab, select the "Policies" button (lower left corner)

Expand the tree on the tree in the upper left panel: Signature Definitions, sig0, All Signatures

Select the signature you want to edit.

Scroll about halfway down the list of signature settings to "Swap Attacker Victim", check the box and set the value to "yes". hit "OK" to save this signature and move on to the next signature.

- Bob