We have M-2850 sensor in inline simulated mode, NSM is 8.1.x. When we generate the 'Top N Attacks' report, the locked events table is blank.
According to TAC, the IPS is in simulated mode and hence will not show the blocked events.However shouldn't we see the 'simulated blocking' as the action taken by IPS?
Also, we cannot see any 'simulated blocked' action for any of the events which are triggered. We can only see 'n/a' and 'inconclusive' for most of the events.
Would appreciate any assistance given.