Why am I not seeing the Security Manager icon for Packet Data and Context Data events, although they are events reported by Cisco IDS 4.x and Cisco IPS 5.x devices?
A. Packet Data events that identify the data that was being transmitted on the network the instant an alarm was detected on IPS and IDS sensors can cause the size of the raw message associated with this event to become very huge. Also, these events are not triggered by signature rules on sensors. As a result, the Security Manager icon is not displayed for Packet Data and Context Data events in CS-MARS for policy lookup.
Related Questions
- Why am I not seeing the Security Manager icon for Packet Data and Context Data events, although they are events reported by Cisco IDS 4.x and Cisco IPS 5.x devices?
- What are the types of CS-MARS events for which the Security Manager icon is displayed?
- Is the Security Manager icon displayed only for events that have 5-tuple data?
