View intrusion events

The Intrusion Prevention System (IPS) helps you detect and block network intrusions and malicious activities based on Cisco Talos threat intelligence.

The Top Intrusion & Malware Events dashlet in the Security Cloud Control Firewall Management dashboard is mapped to Intrusion Prevention and Advanced Malware Protection dashlets in the Monitor page of Catalyst SD-WAN Manager on the Security tab.

Procedure

Step 1

From the Security Cloud Control Home page, click Firewall.

Step 2

Click Dashboard.

Step 3

Navigate to the Top Intrusion & Malware Events dashlet.

Step 4

Click SDWAN under Data Sources.

Step 5

Click the Intrusion Events tab.

Step 6

Select Blocked in the drop-down near the dashlet.

By default, Allowed is selected.

Top Intrusion & Malware Events dashlet displaying the Intrusion Events tab with example intrusion data and selection options.

Step 7

Click the event you want to view in Catalyst SD-WAN Manager.

A cross-launch window of the Catalyst SD-WAN Manager Monitor page appears.

Step 8

Navigate to the Intrusion Prevention dashlet to view the event.