You can configure Catalyst Center to send a notification whenever a rogue or aWIPS attack takes place. Notifications for these events do not appear in the Catalyst Center Notification Center.

To complete this procedure, ensure that you select and subscribe to a rogue event or an aWIPS event.

Rogue events are triggered only for these high threat-level rogues:

• Beacon wrong channel

• Beacon DS attack

• AP impersonation

• Rogue on wire

• Honeypot

• Custom rules created with the threat level set to high

Rogue events are triggered when:

• A high threat-level rogue is discovered in the network for the first time (ROGUE_NEW_THREAT_DETECTED)

• A high-threat-level rogue is deleted from the network (ROGUE_THREAT_DELETED)

• A threat level is changed from High to Potential or Informational (ROGUE_THREAT_LEVEL_CHANGED)

• A threat level is changed from Potential or Informational to High(ROGUE_THREAT_LEVEL_CHANGED)

• A threat level remains High but threat type changes (ROGUE_THREAT_TYPE_CHANGED)

Rogue events payload details:

{
	"detectingApLocation": "string",
	"rssi": "int",
	"threatMacAddress": "string",
	"threatType": "string",
	"detectingApMacAddress": "string",
	"threatState": "string",
	"wlcIp": "string",
	"detectingApName": "string",
	"containmentState": "string",
	"vendorName": "string",
	"ssid": "string",
	"threatLevel": "string"
} 

Commands in payload:

• threatMacAddress: MAC address of the rogue AP

• threatType: Type of rogue threat (Beacon DS Attack, AP Impersonation, Rogue on Wire, Honeypot, or Custom Rules created with Threat Level as High)

• threatState: State of the rogue threat (ROGUE_NEW_THREAT_DETECTED, ROGUE_THREAT_DELETED, ROGUE_THREAT_LEVEL_CHANGED), ROGUE_THREAT_LEVEL_CHANGED, or ROGUE_THREAT_TYPE_CHANGED

• threatLevel: State of the rogue (High, Potential, or Informational)

• detectingApName: Name of the strongest detecting AP

• detectingApMacAddress: MAC address of the strongest detecting AP

• detectingApLocation: Location of the strongest detecting AP

• rssi: RSSI value of the detecting AP that detects the rogue AP

• containmentState: Containment state of the rogue AP (PENDING, NOTCONTAINED, or CONTAINED)

• threatVendorName: Vendor name of the rogue AP

• ssid: Latest SSID or Honeypot SSID

• wlcIp: IP address of the wireless controller

aWIPS events are triggered for all aWIPS threats in the network.

You receive a notification for each detecting AP. If multiple APs detect the same threat, you receive multiple event notifications.

Note

The maximum aWIPS threat notification limit per signature per day is 2500. When the notifications of a specific signature reach this limit, no more notifications are sent for that signature for that day. A warning message displays in the rogue and aWIPS Overview window.

Click View Signatures to view the details of aWIPS signatures that have reached the maximum limit.

For source-based aWIPS threats, source information is sent. Destination information is sent as Not Applicable.

For destination-based aWIPS threats, destination information is sent. Source information is sent as Not Applicable.

For pair-based aWIPS threats, both source and destination information are sent.

aWIPS events payload details:

{
	"sourceVendorName": "string",
	"detectingApLocation": "string",
	"attackType": "string",
	"sourceMacAddress": "string",
	"detectingApMacAddress": "string",
	"wlcIp": "string",
	"detectingApName": "string",
	"targetMacAddress": "string"
}

Commands in payload:

• attackType: Type of the aWIPS attack

• sourceMacAddress: MAC address of the attacker

• sourceVendorName: Vendor name of the attacker

• targetMacAddress: MAC address of the target

• detectingApLocation: Location of the detecting AP

• detectingApMacAddress: MAC address of the detecting AP

• detectingApName: Name of the detecting AP

• wlcIp: IP address of the wireless controller