Manage "Suspicious IP-ET" Continuous Events

Anonymous — Tue, 09 Apr 2019 19:32:17 GMT

Hi,

This is linked in part to a previous post:

https://community.extremenetworks.com/extrememanagement-230297/extremeanalytics-suspicious-ip-et-7823023

At this time XMC is recording 728,320 alarms of this event, and the events log is getting continuously filed with the messages, all from different IP address.

The XMC help, as does the link above mention an 'IP Reputation' dashboard which I am unable to find?

There log looks like its coming from the fact that suspicious IP addresses are being seen, but without the a Dashboard or means of control that I can find the logs are getting swamped.

Maybe its something that is coming in a future release, current version 8.2.4.42?

Many thanks

Re: Manage "Suspicious IP-ET" Continuous Events

Anonymous — Tue, 09 Apr 2019 20:33:23 GMT

I've created this dashboard through the report designer, which I believe gives me the detail in what the Suspicious IP-ET events are:

Pre-built one:

Looks like the IP addresses are clickable but nothing happens. Be good for example that I could create a policy to straight off clicking, say, the high risk endpoints.

topic Manage "Suspicious IP-ET" Continuous Events in ExtremeCloud IQ- Site Engine Management Center

Manage "Suspicious IP-ET" Continuous Events

Re: Manage "Suspicious IP-ET" Continuous Events