6-4
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
Chapter 6 Configuring Event Action Rules
Task List for Configuring Event Action Rules
Caution
The Produce Alert action is not automatic when you enable alerts for a signature. To have an alert created
in the Event Store, you must select Produce Alert. If you add a second action, you must include Produce
Alert if you want an alert sent to the Event Store. Also, every time you configure the event actions, a new
list is created and it replaces the old list. Make sure you include all the event actions you need for each
signature.
Task List for Configuring Event Action Rules
Follow these steps when configuring the event action rules component of the IPS:
1.
Create any variables that you want to use in event action filters.
2.
Create TVRs.
Assign TVRs to your network assets so that you can calculate the RR.
3.
Create overrides to add actions based on the RR value.
Assign an RR to each event action type.
4.
Create filters.
Assign filters to subtract actions based on the signature’s SIGID, IP addresses, and RR.
5.
Configure the general settings.
Specify whether you want to use the summarizer, the meta event generator, or configure denied
attacker parameters.
Event Action Variables
This section describes event action variables, and contains the following topics:
•
About Event Action Variables, page 6-5
•
Configuring Event Action Variables, page 6-5
Log Attacker Packets
Starts IP logging packets containing the attacker address.
Log Pair Packets
Starts IP logging packets containing the attacker-victim address pair.
Log Victim Packets
Starts IP logging packets containing the victim address.
Reset TCP Connection
Sends TCP resets to hijack and terminate the TCP flow.
Request SNMP Trap
Sends request to Notification App to perform SNMP notification.
Request Block Connection
Sends request to Network Access Controller to block this connection.
Request Block Host
Sends request to Network Access Controller to block this host (the
attacker).
Table 6-1
Event Actions (continued)
Event Action Name
Description