6-7
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
Chapter 6 Configuring Event Action Rules
Configuring Target Value Ratings
Configuring Target Value Ratings
You can assign a TVR to your network assets. T he TVR is one of the factors used to calculate the RR
value for each alert. You can assign different TVRs to different targets. Events with a higher RR trigger
more severe signature event actions.
Use the
target-value
[
zero value
|
low
|
medium
|
high
|
mission-critical
]
target-address
ip_address
range
command in service event action rules submode to set TVRs for your network assets. The default
is medium.
To configure TVRs for your network assets, follow these steps:
Step 1
Log in to the CLI using an account with administrator privileges.
Step 2
Enter event action rules submode:
sensor#
configure terminal
sensor(config)#
service event-action-rules rules0
Step 3
Assign the TVR to the network asset:
sensor(config-rul)#
target-value mission-critical target-address 10.89.130.108
Step 4
Check the TVR setting you just configured:
sensor(config-rul)#
show settings
-----------------------------------------------
target-value (min: 0, max: 5, current: 1)
-----------------------------------------------
target-value-setting: mission-critical
target-address: 10.89.130.108 default: 0.0.0.0-255.255.255.255
-----------------------------------------------
sensor(config-rul)#
Step 5
Exit event action rules submode:
sensor(config-rul)#
exit
Apply Changes:?[yes]:
Step 6
Press
Enter
to apply your changes or type
no
to discard them.
Event Action Overrides
This section describes event action overrides, and contains the following topics:
•
About Event Action Overrides, page 6-7
•
Configuring Event Action Overrides, page 6-8
About Event Action Overrides
You can add an event action override to change the actions associated with an event based on the RR of
that event. Event action overrides are a way to add event actions globally without having to configure
each signature individually. Each event action has an associated RR range. If a signature event occurs
and the RR for that event falls within the range for an event action, that action is added to the event. For