Meta for Cisco Sourcefire IPS action taken on an attack

[JinuSunny]

We integrated our cisco IPS with RSA SA . But we are unable to get the action taken by the IPS meta  for any signature match.kindly help on this

[SravanKoneti1]

Hi Jinu,

By default, Action meta key defined in table-map.xml for parsing and in index-concentrator.xml for indexing.  Verify your device support as per RSA Supported Event Sources  list.  If supported, Please reach support with sample logs of device by exporting them from investigation page in SA GUI.

Thanks,

Sravan