cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
708
Views
5
Helpful
2
Replies
Highlighted
Beginner

Sourcefire PCAP

Sourcefire Questions:

 

- How long do the events appear in the Intrusion-Events tab for you to be able to download the PCAP files? Is there a length of time these are visibile for or is there a limit on how many you can see/download?

 

- Once you have downloaded the PCAP file, does it still remain within the Intrusion-Events window?

 

Thanks

 

 

Everyone's tags (6)
2 REPLIES 2
Highlighted
Enthusiast

Re: Sourcefire PCAP

Hi,

I have intrusion events from 2016, so they rotate depending on your setting under System/Configuration/Database/ under "Intrusion Event Database" and how many events you are getting.
The event will stay on the FMC after downloading it.

br, Micke
Beginner

Re: Sourcefire PCAP

Thankyou!