View Intrusion Events
The Intrusion Prevention System (IPS) detects and blocks network intrusions and malicious activities based on Cisco Talos threat intelligence.
The Top Intrusion & Malware Events dashlet on the Security Cloud Control dashboard is mapped to the Intrusion Prevention and Advanced Malware Protection dashlets on the Monitor page of Catalyst SD-WAN Manager on the Security tab.
Procedure
Step 1 | In the Security Cloud Control platform menu, click Dashboard. |
Step 2 | Navigate to the Top Intrusion & Malware Events dashlet. |
Step 3 | Click SDWAN under Data Sources. |
Step 4 | Click the Intrusion Events tab. |
Step 5 | Select Blocked from the dropdown on the right of the dashlet; by default, Allowed is selected. |
Step 6 | Click the event you want to view on the Catalyst SD-WAN Manager. A cross-launch window of the Catalyst SD-WAN Manager Monitor page opens. |
Step 7 | Navigate to the Intrusion Prevention dashlet to view the event. |