cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
993
Views
0
Helpful
2
Replies

No Actions taken by IPS with High Severity event

edisonguerrero
Level 1
Level 1

Hi Comunity,

I wanted to ask about an alert fired on the IPS. The signature has a high severity, but no actions were taken by the IPS. I checked the Event Action Filters and there is not any filter to avoid apply actions to this traffic.

The alarm was:

Thanks.

2 Replies 2

nspasov
Cisco Employee
Cisco Employee

Is your IPS policy set to block or monitor only? 

Thank you for rating helpful posts!

Hi,

By default, the signature has a High severity and the default action is "Produce Alert". Otherway, with a Hihgh Risk Rating, the Event Action Overrides has the acction "Deny Packet Inline" to add.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: