FireSIGHT System generates connection events although logging is disabled

[Nazmul Rajib]

Although all Connection Logging options are disabled in an Access Control policy, my Sourcefire FireSIGHT System still generates a Connection Event.

[Nazmul Rajib]

Reason

A Sourcefire FireSIGHT System generates a Connection Event when an Intrusion Event is generated. A Connection Event is generated on the web interface of the Sourcefire FireSIGHT Management Center for the following reasons:

• Intrusion Block
• Intrusion Monitor

Solution

If this feature is undesired, it may be disabled from the shell using the following command:

> configure log-ips-connection disable