Cisco Cisco Firepower Management Center 4000

The following list describes the information that an intrusion event contains. Note that some fields in the 
table view of intrusion events are disabled by default. To enable a field for the duration of your session, 
click the expand arrow (

) to expand the search constraints, then click the column name under 

.

The date and time of the event.

The event priority as determined by the Cisco VRT.

The impact level in this field indicates the correlation between intrusion data, network discovery 
data, and vulnerability information. For more information, see 

Note that because there is no operating system information available for hosts added to the network 
map based on NetFlow data, the Defense Center cannot assign Vulnerable (impact level 1: red) 
impact levels for intrusion events involving those hosts, unless you use the host input feature to 
manually set the host operating system identity.

One of the following:

a black down arrow, indicating that the system dropped the packet that triggered the rule

a gray down arrow, indicating that IPS would have dropped the packet if you enabled the 

 intrusion policy option (in an inline deployment), or if a Drop and Generate rule generated the 

event while the system was pruning

blank, indicating that the triggered rule was not set to Drop and Generate Events

Note that the system does not drop packets in a passive deployment, including when an inline 
interface is in tap mode, regardless of the rule state or the inline drop behavior of the intrusion 
policy. For more information, see 

, 

, and 

.

The IP address used by the sending host.

The country of the sending host.

The IP address used by the receiving host.

The country of the receiving host.

The original client IP address that was extracted from an X-Forwarded-For (XFF), True-Client-IP, 
or custom-defined HTTP header. To display a value for this field, you must enable the HTTP 
preprocessor 

 option in the network analysis policy. Optionally, in the