Security Intern here given the assignment to find the IP address of an attacker using IBM's IDS.
The event or attack in question is entitled
X509_Weak_Signature_Algorithm, and from what I understand, this attack involves exploiting MD5 to generate rogue certificates to compromise our servers.
When I go to review an individual event log, I noticed that the attacker's IP address is a Class A local IP.
Shouldn't this be a public IP address because we are being attacked by an external host?