topic ExtremeAnalytics "Suspicious IP-ET" in ExtremeCloud IQ- Site Engine Management Center

ExtremeAnalytics "Suspicious IP-ET"

Anonymous — Sun, 03 Mar 2019 06:29:47 GMT

Hi,

Have an entry in ExtremeManagement alarms that states the following:

code:

Alert Name:
Suspicious IP-ET

Seen Count:
85563
 
ThreatType:IP,ThreatSubType:,ThreatSeverity:Warning,ThreatSource:ET,ThreatInitiator: 222.222.222.222, ThreatInitiatorPort: 35596, ThreatTarget: 111.111.111.111, ThreatTargetPort: 80, Value: Suspicious IP: 222.222.222.222

I've changed the IP address to what's actually in the log.

Seems to suggest something untoward is happing to the customers IP on port 80, but not sure exactly what and how Analytics is identifying it as suspicious.

Any ideas?

Many thanks

Re: ExtremeAnalytics "Suspicious IP-ET"

Ronald_Dvorak — Mon, 04 Mar 2019 20:11:57 GMT

Hi Martin,

if you check the alarm config you'd see that the alarm is triggered by "reputation threat detected".

A search in the XMC online help (put in the XMC IP) brings you to the "IP Reputation Dashboard" section.

https://:8443/Clients/help/content/oneview/docs/analytics/analytics_tab/dashboard/c_pur_analytics_tab_dashboard.htm?#IPRep

For me it looks like that the 222.222.222.222 is on the list of untrusted IPs (because it's from China ?).

What I don't get is how I'd acceess this IP Reputation Dashboard because I don't see it on my XMC.

-Ron

Re: ExtremeAnalytics "Suspicious IP-ET"

Anonymous — Thu, 28 Mar 2019 20:58:11 GMT

Hi Ron,

Sorry, didn't get back you to say thanks for the reply... Thanks 🙂

Did you have any luck finding the dashboard? I'm running version 8.2.4.42 and still can't see it?

Perhaps its due in a later release?

Thanks

Re: ExtremeAnalytics "Suspicious IP-ET"

Anonymous — Tue, 09 Apr 2019 20:35:48 GMT

Added this another post, but just repeating here for consistency:

https://community.extremenetworks.com/extrememanagement-230297/manage-suspicious-ip-et-continuous-events-7823245

I've created this dashboard through the report designer, which I believe gives me the detail in what the Suspicious IP-ET events are:

And pre-built one: