Security Intelligence Events

[slymer1965]

Is there any way to drill into a Security Intelligence Event in Sourcefire? I am seeing numerous outbound CnC events coming from a host but cannot see what application, service, etc. is causing the triggered event.

Thanks!!

Scot Lymer

[Dennis Perto]

Hi

Unfortunately there is no way of doing that.

Security Intelligence is the same as Blacklists. It stops the traffic before it knows what Application/Protocol that is used.