Hi Roman, This is addressed at the link below http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/initial/configuration/setup.html#wp1187998Sam

Hi, the alerts on the WCS come from the WLCs so check and confirm you are seeing the same messages on the WLC traplogs. If you are then very likely the clients are spoofing the ap mac addressesSent from Cisco Technical Support iPhone App