malicious rogue vs. rogue?

[charles_sprickm]

Been googling a bit, but I'm not finding what the difference is between a "rogue AP" (I get that) and a "malicious rogue AP".  Also the logging is odd - I get log events of the rogue AP going away, but no mention of it appearing.  Log example:

2017/03/09  14:15:09 | High | A Malicious Rogue[40:5d:82:12:5d:93] detection by AP[1c:b9:c4:35:eb:e0] goes away

That MAC belongs to a Netgear device, so I'm assuming it's some consumer router.  It would be helpful if an SSID was logged as well...

[erin_mcclellen]

I'd still like an answer to this. 🙂

[erin_mcclellen]

Also I don't know why this doesn't trigger an email alert.  I tested that alerts work (see screenshot).  And you can see the checkbox is checked.  This is a ZD on latest 10.x.

[erin_mcclellen]

Bump!  I can open a case if necessary.

It's a pain to get notified of complaints, then login to the ZD, check the logs, see the rogue is there, and then wonder why I have no email telling me about this.  Makes us look sloppy, we're trying to be proactive. The test works correctly and we see the test email. The test email is fine, whitelisted.  Looking in spam box there's no evidence of these alerts.