This article details procedure to list the detected attacks on SRX platform by IDP

Run the following CLI command on the SRX device to find the list of attacks detected by IDP:

CLI> show security idp attack table

HTTP:URL-ACCESS        5
SQL:DB-ACCESS          6

The left column indicates the attack name and the right column indicates the number of time attack that have been detected.


If there are no attacks listed in the table, run the following command to verify if there is an IDP policy loaded and traffic is going through IDP policy:

CLI> show security idp status




In the above screen shot, "URL-MATCHING" is the IDP policy name that is loaded. The other parameters also indicate if the current packets are going through IDP.

For additional troubleshooting, refer to KB16109 [juniper.net] .