cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

1681
Views
0
Helpful
2
Replies
ericnlv
Beginner

Is there a way to download event information

Hello

 

I do not support the IPS devices but have been asked to see if I can gather some info. On the FMC webpage, I have selected Intrusions->Events. I specified a date range and I have a page of events listed. If I then click VIew All button, I see all of the individual events for the time period. Is there a way for me to export that list so that I can review it outside of the interface? I need to be able to review  the Source and Destination info along with the Message generated.

 

Using Cisco Firepower Management Center for VMWare Version 6.2.3.

 

Thanks for any instruction!

 

Eric

2 REPLIES 2
Sheraz.Salim
VIP Advocate

you have only few options. one is reporting you can create a reports but even in them it wont give you all the ip address source and destination with ports. FMC is great tool for IPS/IDS but not very good when it come to reports or putting off the information from the FMC.

hm.. unless you dig in and create a syslog and sent to a external syslog servers. but even in that you have to filter it.

please do not forget to rate.

Thank you Sheraz. Actually, Reports is exactly what I needed. I was able to create a custom report and include all the necessary information and save as a csv.

 

Thanks for your reply.

 

Eric

Content for Community-Ad