AiProtection - Two-Way IPS event

[OzarkEdge]

So what does this event mean:

I believe the Source IP is assigned to the Destination device, so it seams to suggest that the user (me) was browsing on the Nexus 7 when a WEB Cross-site Scripting event triggered AiProtection Two-Way IPS.

What does Client Device Infected mean? It feels like a false positive to me. Does it simply mean that the client browser encountered an attempt at cross-site scripting and AiProtection blocked it... so no real infection?

OE

 

[Paliv]

I haven't seen one of these before. Always wondered if it even worked. They definitely need better documentation to help us understand what is happening. I will be interested also to hear if anyone has insight into an alert like this. I do know if I go to the wicar site and do test download and scripts it shows up on two-way IPS. I just tested their CSS link and it shows as a 'malware accomplice', but I didn't get this warning. It could just be the type of device I'm using (pc versus phone) and the type of attack.