configure secure ids version 4 to send the events to netforensics

[fengluo]

I have 13 sensors, but only 9 can be seen in netforensics, I don't know what to check to make sure other sensors are sending event to netforensics.

Philip

[pcomeaux]

4.x sensors do not send data to external servers.

External servers, such as NF or IEV or Sec Mon need to collect the data from the sensor by way of a subscription. So this would be the first thing to check within NF - make sure NF is configured to collect from all the sensors you would like.

Also, the sensors need to permit the IP address of the NF server to communicate with it. So this would be the 2nd thing to check.

Please let us know if you need details on how to check each of these items. If so, tell us what you are using to manage the sensors - CLI, IDM or IDS MC.

thanks

peter

[fengluo]

I am using VMS and IDS MC to manage the sensors.

[pcomeaux]

Ok - you need to ensure that within IDS MC that the sensors in question permit the IP address of the NF device to manage it under "Configuration --> Settings --> Communications --> Allowed Hosts"

As mentioned before, also check to see if the other 4 sensors have been configured within NF.

thanks

peter