Suggestion for Cisco Threat Response

[bfl1]

One thing I haven't been able to find in the CTR program is the ability to read a captured packet. I have been chasing a handful of chronic false positives and being able to use etherreal to view the packet has been priceless. Is this capability within CTR? If not, will it be in future releases?

thanks

[drolemc]

The entire idea of using 'Threat Response' is to avoid getting boggled down by false positives. The CRT is built to analyse data and bring only actual attcks to your notice. It does not however supress the generation of alarms. More information is available in the whitepaper at http://www.cisco.com/en/US/products/sw/secursw/ps5054/products_white_paper09186a0080148743.shtml