IPS reports

[Reshma Raje]

The attacks blocked by IPS even shows internal IP addresses... Why is that so? Can some help me understand this?

[nspasov]

There are several possibilities here but the top two things that come to mind are:

1. The actual host on the inside of your network is doing the attack

2. The attacker is using a spoofed IP

Are you able to drill more into the event and investigate and correlate the events?

Thank you for rating helpful posts!