reporting question

[shawn.posthumus]

Is there a way to generate a report on the number of shuns on a sensor or just to pull out the specific signatures you are looking for? Thanks,

Shawn

[mkodali]

Hi Shawn,

Depends on the sensor version you are using. This is more convenient on the IDM than on CLI.

On CLI :

Sensor version 5.0 : You can try for the shuns : "show statistics network-access"

and

for signatures you can try "config term -> service signatureDefinition sig0--> show setting | include ". This will just confirm that the particular sig exists, nothing more than that.

Sensor version 4.x :

For shuns : "show statistics networkAccess"

For signature : "conf t --> service virtualSensorConfiguration virtualSensor --> tune --> show setting | include "

On IDM it should be easy to navigate and self-explanatory to get the above information.

Hope this helps.

[shawn.posthumus]

Thanks for the response, I didnt realize it was that easy to pull off the cmdline. I guess I didnt word my question well up above. Im more interested in getting data of the number of times hosts have been shunned, say in the last week, or month, and what signatures they fired on. Thanks again,.

Shawn