How to get a smarter log?

[Hugo_vd_Kooij]

Here is my puzzle I have with a customer.

We incresed security by switching IPS from detect to prevent.

We noticed a lot of DETEC log entries and were going over the steps to make sure we didn't miss anything. And everything is as it should be.

Then I did track the specific source and reviewed the logs and found the reason.

If another blade (FW or VPN) drops the packet/connection then IPS only logs a DETECT as another blade did the blocking action. So now I would very much like to see if there is a simple way to get the details from the DETECT log entry and then open a second log tab with a filter based on the Source IP and destination IP of the DETECT log line I am investigating.

Anyone with a suggestion in this regard?

[elbergfeldt]

Hi! 

Not sure if there is an easy way of doing this in one click, but you can undock the logs tab (top right button) and have two windows open at the same time side by side while you conduct your investigation