In my organization, we have an IPS behind a firewall. Each time a security event is triggered, I am left to wonder if the attack is really successful. For events that are set to drop in inline, we can be assured that the attack is most unlikely to be unsuccessful. But how do we determine if an attack is successful for events that are set to alert only?
In cases like these, I would look at the payload and PCAP to grab as much information as I can. However, most of the time, I still can't determine if the attack is successful.
For cases like these, how do we determine if an attack is successful?