Dear All,
I am looking for a cisco solution which can give me schedule mail with IPS log report. Below is what I am looking for,
A) Periodically mail me with IPS log report. such as daily or weekly.
B) The report should include Source addres+Destination Address+Timestamp+SignatureID+SignatureName.
C) Please see the attchaed file 01 - which I used to get in my previous organization from Cisco VMS. It was a 1 day report for 1 of the IPS back in 11th May 2008.
Now here is what I have gone through,
1) I am looking for a cisco solution.
2) I have check with IME 7.x. They can not mail report. But they can generate report on specfic formate. These reports are either Source or Destination or Signature based. I am not able to get the Report like I said above in point no (B).
3) I am currently checking with cisco CSM. Only difference with IME I found is that it can take log from Firewall and It can mail the report periodicaly. But the Report format is still same for IPS.
4) The report generated by IME and CSM are same and not very effective in a sence that it wont have the full information. I mean when [time] "X" type [signature name/ID] attack is happend by "Y" [SourceIP] source to "Z" [Destination IP] destination. This is what I mean at point (B) which I used to get with VMS.
5) I am not sure whether by CSM I can customize report and get the type of Report that I am looking for. If anyone know that it is possible through CSM please share with me.
6) We have Syslog-NG but we want something viewable for Management's understanding.
Please it will be very helpful for me, if anyone can tell me whether cisco currently has a solution which can effectivity report like this type. Please let me know.
Thanks//
Adnan
