How to find out the IPS/IDS logs.

[Satish]

Hi Friends,

How to find out the IPS/IDS/Anti-spoofing Logs with CLI or GUI.

Regards

Satish

[gbogojevic]

Hi Satish

You can find it under Monitor-> Threat tab.

[DctrG]

And CLI:

> show log threat

Regards,

Guillermo.

[NickySorot]

can you suggest where we can see only IPS logs for audit purpose?

[Satish]

panos HULK Steven Puluka hshah please suggest !!!

[panos]

can you check that

What are the Threat Log Values for Threat ID and Direction

you can filter the threat logs then.

[mivaldi]

> show log threat start-time equal 2014/10/01@10:00:00 end-time equal 2014/12/30@10:00:00 suppress-threatid-mapping equal no csv-output equal no direction equal backward

Additional suggestions:

Adjust your start-time and end-time

Remove 'direction equal backward' if your want to make newest event show last

Use "csv-output equal yes" if you want to export to a spreadsheet

Use " > set cli pager off " to avoid being asked to press spacebar (useful for logging TTY session output at one strike)

[pulukas]

I'm not sure I follow exactly what kind of report you are looking for.

As a general rule, I think the ACC tab is the best place to drill into threat activity and reporting.  You have a lot of filtering options to narrow down your area of interest.

The monitor tab and threat monitor can also be a good top level view to understand where you want to drill into the data using the monitor tab reporting functions.

[Satish · Accepted solution]

Thanks all for reply.

I think IPS, IDS, anti-virus, anti-spyware and vulnerability combined of all is called threat logs.

Regards

Satish

[DctrG]

That is correct Satish

Regards,

Guillermo.