FireSight : How to display the list of Blocked Intrusions

[guillerm]

Hello,

among the numerous and useful menus/options available under FireSight (used to manage Firepower IPS embedded in ASA Firewalls), is there 1  that allows  to display the list of detected intrusions that have been blocked by the Firepower ?

thanks for any feedback

[nspasov · Accepted solution]

Yes you can. Go to Analysis > Intrusions > Events > Edit Search. This will load a new window and in there you can see a field called "Inline Result." There you can set the result to "dropped, would have dropped, etc" You can save this search and use it later. 

Thank you for rating helpful posts!

[zakameeri]

what is the difference between dropped and would have dropped?

[Marvin Rhoads]

"would have dropped" applies when a policy is monitor only (IDS) or when the module is not inline (e.g. on a span port) and thus incapable of telling the network or parent device to drop the connection.

[zakameeri]

Thanks Marvin for the response and clarification.

[pro_engineering]

Just adding quick question, in my search for intrusion event i see Blank in Inline Result, like no action. What could be the reason for this? And how could i figure it out that event was dropped or passed. etc.

Thanks