Wireless Rogue AP Detected

This is a security incident, not a technical failure. A malicious rogue access point is broadcasting the legitimate corporate SSID 'Corp-WiFi' in the parking lot, likely conducting an evil twin attack to harvest user credentials. The Cisco WLC WIDS system has correctly identified this as a malicious SSID spoofing attempt with 12 clients already associated to the rogue AP. The WLC monitoring appears functional as it's successfully detecting and reporting the threat.

1. Immediately initiate RF containment of the rogue AP (BSSID: aa:bb:cc:dd:ee:ff) through the WLC to disrupt the attack. 2. Send security alert to IT security team and facility management about unauthorized device in parking lot sector B. 3. Verify legitimate corporate APs are functioning normally and clients can connect to authentic Corp-WiFi network. 4. Monitor for client reconnections to legitimate APs. 5. Dispatch physical security to locate and remove the rogue device. 6. Consider temporarily changing corporate WiFi credentials if credential harvesting is suspected.