We integrated our cisco IPS with RSA SA . But we are unable to get the action taken by the IPS meta for any signature match.kindly help on this
By default, Action meta key defined in table-map.xml for parsing and in index-concentrator.xml for indexing. Verify your device support as per RSA NetWitness Supported Event Sources list. If supported, Please reach support with sample logs of device by exporting them from investigation page in SA GUI.
Retrieving data ...