Exfiltration

[nancy.f.lee]

How do i go about checking to see if our IDS can detect "low and slow" data exfiltration?                   

[roshan.maskey]

Not easy to grt that directly from IPS. Send alert logs to Splunk and create Splunk query to detect low volume attacks.

Sent from Cisco Technical Support iPad App