Packet Capture for IDS matches

[sec_eng_owl]

We have a few Meraki MX devices on 16.16 firmware, have configured IDS in Detection mode, sending them out via syslog. This works.

When we get an event, we want to determine whether it is accurate or false positive. This is best done with a packet capture that contains the packet that matched the snort signature. What is the best way to do see that matching packet or few?

Thank you,

D

[Inderdeep]

@sec_eng_owl : check this out

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Packet_Capture_Overvi... 

[sec_eng_owl]

That does not seem like the correct solution since the captured packets are not limited to IDS signature matches. We don't want all packets. We just want packets that match an IDS signature, so we can evaluate the packet content against the signature itself to see if the match is a false positive.

Can Meraki capture only packets for IDS signature matches?

[sec_eng_owl]

A related function in Cisco FTD is described here: Firepower Management Center Configuration Guide, Version 6.2

From link:

"When the system identifies a possible intrusion, it generates an intrusion event, which is a record of the date, time, the type of exploit, and contextual information about the source of the attack and its target. For packet-based events, a copy of the packet or packets that triggered the event is also recorded."

This what we need in Meraki MX too - the last part about a copy of matching packets.

[BrandonS]

In Security Center if you click through to the event you can see the packet and download the pcap of just that event.  Here is an example I found:

[sec_eng_owl]

BrandonS, that is exactly what I was looking for, but we don't have the Inspect Packet option. My signature match options are shown below:

How do I enable the Inspect Packet option? Encouraging feedback so far.

Thanks,

D

[BrandonS · Accepted solution]

I think you may only see it under the MX Events tab and not the MX Summary tab.  Which makes sense because you would be interested in the specific event, not the summary of events in this case of seeing the packet.

[sec_eng_owl]

Bingo. That's it! Thanks for your help tracking that down!