Sourcefire PCAP

[danlawrance1]

Sourcefire Questions:

- How long do the events appear in the Intrusion-Events tab for you to be able to download the PCAP files? Is there a length of time these are visibile for or is there a limit on how many you can see/download?

- Once you have downloaded the PCAP file, does it still remain within the Intrusion-Events window?

Thanks

[mikael.lahtela]

Hi,

I have intrusion events from 2016, so they rotate depending on your setting under System/Configuration/Database/ under "Intrusion Event Database" and how many events you are getting.
The event will stay on the FMC after downloading it.

br, Micke

[danlawrance1]

Thankyou!