Heads Up :
The post you are writing will appear in a public forum. Please ensure all content is appropriate for public consumption. Review the employee guidelines for the community here.
The event "unknown device event type" occurs when the MARS signature list differes from that of the reporting device. What is the process to update this list on MARS? With routine signature updates for IPS sensors, am I required to wait for an update...
Has anyone else been seeing large occurences of this signature from what appears to be normal web application/browsing activity? No further tuning of the sig has been performed.
Yes, I also see quite a lot of these (3251) from virtualized web and VPN environments. Sometimes this sig can fire because of packet trickery involved with some of environment protocols. I'm interested to hear what others are doing, or if this Sig is...
