Cisco IDS-4230-FE - Intrusion Detection Sys Fast Ethernet Sensor, Руководство по установке и настройке

Страница: 362 / 450

Appendix A Intrusion Detection System Architecture
System Components
A-36
Cisco Intrusion Detection System Appliance and Module Installation and Configuration Guide Version 4.1
78-15597-02
You can also use parentheses around a single- or multiple-character pattern to
instruct the software to remember a pattern for use elsewhere in the regular
expression. To create a regular expression that recalls a previous pattern, you use
parentheses to indicate memory of a specific pattern and a backslash (\) followed
by a digit to reuse the remembered pattern. The digit specifies the occurrence of
a parentheses in the regular expression pattern. If you have more than one
remembered pattern in your regular expression, \1 indicates the first remembered
pattern, and \2 indicates the second remembered pattern, and so on. The following
regular expression uses parentheses for recall:
a(.)bc(.)\1\2
This regular expression matches an a followed by any character, followed by bc
followed by any character, followed by the first any character again, followed by
the second any character again. For example, the regular expression can match
aZbcTZT. The software remembers that the first character is Z and the second
character is T and then uses Z and T again later in the regular expression.
EventStore
This section describes the EventStore and its responsibilities.
This section contains the following topics:
•
About the EventStore, page A-36
•
Major Data Structures, page A-38
• IDS Events, page A-39
About the EventStore
Each IDS event is stored in EventStore with a time stamp and a unique,
monotonic, ascending ID. This time stamp is the primary key used to index the
event into the fixed-size, indexed EventStore. When the circular EventStore has
reached its configured size, the oldest event or events are overwritten by the new
event being stored. SensorApp is the only application that writes alert events into
the EventStore. All applications write log, status, and error events into the
EventStore.