topic Re: reporting question in Network Security

reporting question

shawn.posthumus — Sun, 10 Mar 2019 09:21:01 GMT

Is there a way to generate a report on the number of shuns on a sensor or just to pull out the specific signatures you are looking for? Thanks,

Shawn

Re: reporting question

mkodali — Tue, 22 Mar 2005 15:19:09 GMT

Hi Shawn,

Depends on the sensor version you are using. This is more convenient on the IDM than on CLI.

On CLI :

Sensor version 5.0 : You can try for the shuns : "show statistics network-access"

and

for signatures you can try "config term -> service signatureDefinition sig0--> show setting | include ". This will just confirm that the particular sig exists, nothing more than that.

Sensor version 4.x :

For shuns : "show statistics networkAccess"

For signature : "conf t --> service virtualSensorConfiguration virtualSensor --> tune --> show setting | include "

On IDM it should be easy to navigate and self-explanatory to get the above information.

Hope this helps.

Re: reporting question

shawn.posthumus — Tue, 22 Mar 2005 15:37:14 GMT

Thanks for the response, I didnt realize it was that easy to pull off the cmdline. I guess I didnt word my question well up above. Im more interested in getting data of the number of times hosts have been shunned, say in the last week, or month, and what signatures they fired on. Thanks again,.

Shawn