Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About sec_eng_owl
Community Record
7
Posts
0
Kudos
0
Solutions
Badges
Jul 15 2022
12:25 AM
We are on 16.16, not sure about the license. I checked all our devices and tried a few different snort signatures on each, and I found an egress suspicious TLD query signature that let me inspect it. Other signatures on the same device did not have the option. Why does it vary per signature? Also the Source column in the MX Events table shows a tiny "Meraki Network OS" under the hostname for signatures that I can inspect too, if that is of any help.
... View more
Jul 14 2022
11:17 PM
Related to this thread - https://community.meraki.com/t5/Security-SD-WAN/Packet-Capture-for-IDS-matches/m-p/141960 When I am looking at Security Center -> MX Events and choosing an event from today, I do not get an Inspect Packet option. I thought this was previously available. Was that option removed? Example options from MX Events tab:
... View more
Mar 8 2022
11:52 AM
BrandonS, that is exactly what I was looking for, but we don't have the Inspect Packet option. My signature match options are shown below: How do I enable the Inspect Packet option? Encouraging feedback so far. Thanks, D
... View more
Mar 8 2022
8:53 AM
A related function in Cisco FTD is described here: Firepower Management Center Configuration Guide, Version 6.2 From link: "When the system identifies a possible intrusion, it generates an intrusion event, which is a record of the date, time, the type of exploit, and contextual information about the source of the attack and its target. For packet-based events, a copy of the packet or packets that triggered the event is also recorded." This what we need in Meraki MX too - the last part about a copy of matching packets.
... View more
Mar 8 2022
8:41 AM
That does not seem like the correct solution since the captured packets are not limited to IDS signature matches. We don't want all packets. We just want packets that match an IDS signature, so we can evaluate the packet content against the signature itself to see if the match is a false positive. Can Meraki capture only packets for IDS signature matches?
... View more
Mar 7 2022
9:18 PM
We have a few Meraki MX devices on 16.16 firmware, have configured IDS in Detection mode, sending them out via syslog. This works. When we get an event, we want to determine whether it is accurate or false positive. This is best done with a packet capture that contains the packet that matched the snort signature. What is the best way to do see that matching packet or few? Thank you, D
... View more
© 2024 Cisco Systems, Inc.
