Viewing the Threats List

To view the Threats List table, complete the following steps:

1. In the WebUI, set the filter to one of the options under groups that has IDPS Intrusion Detection and Prevention System (IDPS) monitors, detects, and prevents threats in the inbound and outbound traffic. Aruba IDPS provides an extra layer of protection that actively analyzes the network and takes actions on the traffic flows based on the defined rules. It inspects data packets, and if any threat is identified, acts real-time to prevent it.-supported gateways.

   For all devices, set the filter to Global. The dashboard context for the selected filter is displayed. Alternatively, you can select the IDPS-supported gateway from Devices > Gateways list to view the threat details for a particular device.

2. Under Manage, select Security > Gateway IDS/IPS.
3. Click the List icon to view the Threats List table.

The Threats List table provides the following information:

• Occurred On—The timestamp of the gateway system clock specifying when the threat was detected.
• Gateway—Name of the gateway in which the threat was detected.
• Model—The gateway model number.
• Client Role—The client role corresponding to the source where the threat is identified.
• Ruleset Type—The ruleset type currently running on the device. It is the IDPS engine version such as 4x or 5x.
• Type—The type of event in which the threat is identified.
• Source—The IP address of the host from where traffic is initiated.
• Destination—The IP address of the host where traffic is destined to.
• Geo Location—The geographic location details.

  • Source—The geographic location of the host that is initiating traffic.

  • Destination—The geographic location of target host that is receiving the traffic.
• Severity—The severity of the threat as classified by the ruleset.
• Action—The action defined in the ruleset.
• Description—The signature description of the threat event detected.