AnsweredAssumed Answered

Meta for Cisco Sourcefire IPS action taken on an attack

Question asked by Jinu Sunny on May 2, 2017
Latest reply on May 3, 2017 by Sravan Koneti

Like • Show 0 Likes0
Comment • 1

We integrated our cisco IPS with RSA SA . But we are unable to get the action taken by the IPS meta for any signature match.kindly help on this

No one else has this question

Outcomes

1 Reply

Sravan Koneti May 3, 2017 4:36 AM
Mark Correct
Correct Answer
Hi Jinu,

By default, Action meta key defined in table-map.xml for parsing and in index-concentrator.xml for indexing. Verify your device support as per RSA NetWitness Supported Event Sources list. If supported, Please reach support with sample logs of device by exporting them from investigation page in SA GUI.

Thanks,
Sravan
1 person found this helpful
Like • Show 0 Likes0
Actions

Meta for Cisco Sourcefire IPS action taken on an attack

Outcomes

Related Content

Recommended Content