Is there a way to search for a single problem IP in Incidents?

[rcwally5192]

How do I search for a single IP in Incidents?  Or  do I search somewhere else?

[Jia Liu]

You can run a query and enter the problem IP as the source or destination IP.

Here's the configuration guide for your reference:

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/user/guide/combo/q_report.html

[rcwally5192]

thank you! I knew there had to be a way, but of course I am in a hurry!

Cheryl Wahlheim

Cyber Security

S.M. Stoller

U.S. Department of Energy

Office of Legacy Management

(720) 880-4341

[Jia Liu]

You're welcome.