Endpoint Protection

Do we have any reporting option in SEPM to generate the logs for specific signature id for IPS. It is possible by following way. However, I need to get for the allowed traffic. Is it possible through the existing reports or Do we have any query to generate this.

Monitors tab -- Logs

Set log type to network threat protection

Set log content to attacks

This is the only way in SEPM. You can also set Event Type to Intrusion Prevention to narrow it down a bit more.

To get more advanced you could probably query the DB directly if you knew what you're looking for.

Symantec Endpoint Protection Database Schema

Symantec Endpoint Protection 12.1.5 Database Schema

You sould query the AGENT_SECURITY_LOG_1 table, for name and ID this is the query.

select  CIDS_SIGN_ID,STR_CIDS_SIGN_ID from AGENT_SECURITY_LOG_1

are you using SQL or embedded database?

SQL database

You'll need to query it for the info you need.

That should still work... have you tried?

Hi Secin,

This is easily accomplished with exported "IPS attacks" logs.  In MS Excel, check or uncheck the SID you are interested in:

However, I need to get for the allowed traffic.

Is it the audit signatures that you are interested in, if the traffic was detected but allowed?

Please update the thread if you need more assistance!  This article may be worth a look...

Two Reasons why IPS is a "Must Have" for your Network

https://www-secure.symantec.com/connect/articles/two-reasons-why-ips-must-have-your-network

With thanks and best regards,

Mick

I ran the query and I cam see few signature name and ID. I would like to know few things on this.

1) Is everything shown like what ever it got allowed and blocked

2)Is it showing the detected signatures

Hi Mick,

I have added few signatures in Intrusion Prevention Exceptions and the action is allow. I would like to know whether there was any traffic detected for that signature.

IPS will block unless you specify otherwise.

It shows the SID in the name itself.

It would still show in the logs, whether set to block or allow (if you changed this action).

those were the onces which agents used to block .. detection IPS

if you dont see your custom IPS then it was not used for any detection

which logs

On the client check the security log

If SEPM, the one you posted above in your original post