Cisco CS-MARS-20-K9 - Security MARS 20, Руководство пользователя

Страница: 436 / 588

21-16
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 21 Rules
Constructing a Rule
Working Examples
The examples in this section demonstrate the use of variables, in particular, how to use variables to
detect Deny patterns.
Note We recommend that you study the system inspection rules for more complex examples. To view a list
of system rule names and descriptions, see
Appendix D, “System Rules and Reports.”
Note
For a single offset rule, the variables SAME and SAME_ANY_DEST_PORT can be substituted in any
of the examples for $TARGET01 and $ANY_DEST_PORT1, respectively. The “ANY” in
$ANY_DEST_PORT1 means either UDP or TCP protocol.
Example A: Excessive Denies to a Particular Port on the Same Host
Figure 21-3 Rule for Excessive Denies to a Particular Port on the Same Host
In this example, the rule fires when 100 of the specified events occur from any source IP address to the
same destination IP address, and the destination port numbers are identical.
Example B: Same Source Causing Excessive Denies on a Particular Port
Figure 21-4 Rule for Same Source Doing Excessive Denies on a Particular Port
In this example, the rule fires when 100 of the specified events occur that have the source IP address,
any Destination IP address, and identical destination port numbers.
Example C: Same Host, Same Destination, Same Port Denied
Figure 21-5 Rule for Same Host, Destination, Same Port Denied
In this example, the rule fires when 20 of the specified events occur that have the same source and
destination addresses, and identical destination port numbers.