IPS Attack direction

[80fd220b-e3b5-4]

Hi everyone,
On my checkpoint 80.30 I would like to know, for a generic IPS log, which field tell me the direction of attack, in order to get who is the attacker, the pc or the server. I think that is simple for the checkpoint by looking the direction of the attack signature . Please do not confuse the session TCP/IP direcion with the attack direction.
thanks a lot.
Emi

[Nick_Doropoulos]

Hello,

You could use the IPS Security Logs found in sk144192.

I hope this helps.

[emiliano_mastro]

hi nick, thanks for answer, but I had already seen that sk, but there isn't a field for attack direction

[Vladimir]

I think that the attacks should be treated as correlated events and not by a single IPS log entry.

Whole point of multi-vector attacks is the difficulty in attribution and necessity of identifying all of their components. 

[Nick_Doropoulos]

I fully agree with your assessment Vladimir!