So now that we have our ID/IPS profiles being used as part of a rule with the
shooting firewall, it's now time to go ahead and test and verify to see whether
or not the ID/IPS policies and rules that we've applied are picking up the
traffic flows between this client right here that's connecting to and
interacting
with our Metasplatable version 2 device right here. So I took the liberty of
running a whole bunch of different end map scans. There's one that's just
finishing up right there. And in addition to that I also launched several
different attacks using Metasplatable. So some of that traffic definitely WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
different attacks using Metasplatable. So some of that traffic definitely
should
be picked up and identified via the ID/IPS policy and corresponding rule. So to
verify that let's head over to the NSX manager and see what it found. So here
in the NSX manager we'll go to the security tab up here on top, we'll expand
the left-hand side and then on the first option here security overview we'll
click
on that and then here under threat event monitoring we'll now click on ID/IPS.
And sure enough we now have something to look at. So here are intrusion events
and
unique intrusion signatures that were matched with one of them in the high WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
unique intrusion signatures that were matched with one of them in the high
category and seven of them in the suspicious category. Also from here if we
had gateway-based intrusion detection also set up we could filter based on that
.
So if we click here under all traffic we click on gateway only it should be
nothing and everything should be under the distributed only category because
that's where our current rules are in place. Then if we continue to scroll down
here is our distributed IPS/IDS summary also showing the top VMs which is our
Kali 10 box is initiating all that traffic and if we scroll down further we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Kali 10 box is initiating all that traffic and if we scroll down further we
have our gateway-based ID/IPS which we don't have enabled yet. So the cool
thing
is right from here if we want to get more information we could go to security
on
left down to under threat event monitoring ID/IPS or we can just click
right here and it'll take us right there. So let's click here on this section
for
intrusion events and that whisks us away through time and space over here to
IPS/IDS. That's currently what we're looking at right here and so because we
are looking at the distributed only earlier that's where it took us to here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
are looking at the distributed only earlier that's where it took us to here
so we could click on all traffic and that would include any gateway-based
ID/IPS that we have as well. So this showing is the timeline for some of those
attacks also if we want to remove some we could say for example I don't want to
see anything that's low or medium or high and then we collapse the left-hand
side gives the more room or suspicious and then it would only show us the
critical alerts which I currently don't have any so let me just ask for
critical
and high and that's not showing us this highlight right here so if we hover
over that it gives us more information on it. Also if we click here it also WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
over that it gives us more information on it. Also if we click here it also
expands it down here below so we can get more information on it. So here we
have
the impact score the severity last detected and information if we scroll
down a little further has details about the parties involved. So if we continue
to scroll down here and the purple is indicating that it was detected only and
because I had set the rule up to detect only and not to prevent that's why we
wouldn't expect to see anything in green here where it actually stopped the
traffic. It also includes the signature ID that was matched on the signature
revision and also information about the technique and the tactic we can click WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
revision and also information about the technique and the tactic we can click
on
these hyperlinks to get more information on those. So we click here on network
shared discovery that opens up a new window with more details regarding that
type of an attack. So if we brought these others back in as well it would then
show us all the information regarding any of those that were applicable. So
here we have some high if we continue scrolling down we have some they're
suspicious if we expand that again I'll give us more details on where it was
identified the hosts involved and also the action that was taken and links to
more information.