Unknown Attack (4203020)

[lubomir_cerny]

Hi.

After new signature set version 9.8.33.6deployment, I can see several attack name "Unknown".Such attack log has no description, no matching criteria:

Seems some signature issue. Can anyone confirm ?

[mjesmer · Accepted solution]

Have you tried clearing the Manager Policy Cache? 

[lubomir_cerny]

Yes. cache flushed. No change. No Attack Name, only some internal ID 4203020

Update: After delete of policy cache, the old events are still marked as Unknown but all new events are identified OK.

[mjesmer]

Ok so you are now seeing the appropriate name for new alerts coming in?

Old attacks won't change to the correct name, just the new ones.

[lubomir_cerny]

No more Unknown attack in Log today. Seems flush cache is sollution.
thx.