Version 7.0
153
Performance Monitoring and Alarms
Performance Monitoring and Alarms
3. Alarms
3.4.6
IDS Threshold Cross Notification
IDS Threshold CrossNotification
Description
This notiofication is sent for each scope (IP or IP+Port) crossing a
threshold of an active alarm.
SNMP Alarm
acIDSThresholdCrossNotification
SNMP OID
1.3.6.1.4.1.5003.9.10.1.21.2.0.100
Default Severity
AlarmType
Other
Probable Cause
Alarm Text
Threshold cross for scope value IP. Severity=minor/major/critical.
Current value=NUM
Status Changes
Corrective Action
1.
Identify the remote host (IP address / port) on the network which
the Intrusion Detection System (IDS) has indicated is malicious.
Note that the IDS determines a host to be malicious if it has
reached or exceeded a user-defined threshold of malicious
attacks (counter).
2.
Block the malicious activity.
