Managed switch detected as intrusion

[mdeth]

Hi,

Our antivirus software keeps detecting and blocking "OS detection" intrusions originating from one of our cisco switches.
Does anyone have an idea what could be triggering the intrusion detection? My first thought was that maybe CDP wasn't playing nice with the software but even after disabling it we get the same intrusion detections.

[Aref Alsouqi]

Would you mind sharing the intrusion event for review?

[mdeth]

This is what we see in our AV dashboard.

We could of course simply enable an exception for the switch IP but since we're not yet sure whether it's a false positive or an actual intrusion attempt we'd rather not at this time.

[Aref Alsouqi]

Mmm, it does not say much. I would try to look at the documentation to trying to see what values would trigger the OS Detection event and take it from there.