Firepower Intrusion Event Alerting

[ChristopherCraddock66504]

Dear Community,

We have IPS (Inspection) enabled on several of our rules in our Access Control Policy. Eventhough we can see the intrusion events in Analysis -> Intrusions-> Events, we do not see any of these intrusion events in our syslog files. I was doing some reading and came across this article which intimates that the syslog settings are set under the intrusion policy itself:

https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/external_alerting_for_intrusion_events.html#ID-2212-00000110

However, when I look at the intrusion policy, I don't have an "Advanced option" or see anywhere I can enable syslog alerting for intrusion events.

Where do I need to go in the FMC to make sure intrusion events are sent to syslog? We are already sending Connection Events to syslog and have syslog enabled under the platform settings.

Thank you. 

[balaji.bandi]

check below :

https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Configuring_External_Alerting_for_Intrusion_Rules.html#ID-2212-000001bf

[ChristopherCraddock66504]

Balaji,

Thank you for the response. For the life of me I cannot find this section. Can you tell me the exact path of where to find the advanced setting? I am looking at the Advanced settings of the ACP but cannot find this option. I am also not seeing any Advanced settings in the Intrusion Policy either. Running code 7.0.1.1.

Thank you.