1 Reply Latest reply on Oct 30, 2007 5:28 AM by mdyer

    ips

      hi all,

      i have sensor 1400 with:
      signatures 4.1.9.5
      s/w ver. 4.1.1.49
      h/w ver. 3.0.0
      management sw 4.1.1.15
      i see traffic passing through as statistics are counting up , packets are going back and forth but the incidents in real time alert manager page is empty
      i have also tried it previous version 3.1.513
      and with sensor 2600
      i have tried both in span ports and inline
      all these efforts result in the same conclusion-->>>>"" empty pages ""

      any help much appreciated
      thanks
        • 1. Which policy to you have applied?
          mdyer
          Which ruleset and policy do you have applied? An easy way to see everything is to create a copy of the 'all inclusive with audit' ruleset and then create a corresponding policy based off of the copy. I normally do this in demo scenarios so that I can explain how the rulesets relate to policies. Next step is to apply the policy to the interfaces you want.

          Once the ruleset is in place, you can go to the detail view in ISM and you should see the alerts being generated. You won't see anything in the incidents view unless you're using incident generator.