When an event shows up in the event viewer the details pane to the right has all the details of the event. One of the sections is "Response" it lists "IP Logged: True/false" etc. If I have a sig with an action of "deny packet inline" shouldnt I see something in the "response" section? I guess I thought I would have a way of knowing what action the sensor took for the sig. Is there a way within the event viewer to know what action the sensor took?
