Task List For Configuring Event Action Rules; Event Action Variables - Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual

Task List for Configuring Event Action Rules

Table 6-1
Event Action Name
Log Attacker Packets
Log Pair Packets
Log Victim Packets
Reset TCP Connection
Request SNMP Trap
Request Block Connection
Request Block Host
The Produce Alert action is not automatic when you enable alerts for a signature. To have an alert created
Caution
in the Event Store, you must select Produce Alert. If you add a second action, you must include Produce
Alert if you want an alert sent to the Event Store. Also, every time you configure the event actions, a new
list is created and it replaces the old list. Make sure you include all the event actions you need for each
signature.
Task List for Configuring Event Action Rules
Follow these steps when configuring the event action rules component of the IPS:
1.
2.
3.
4.
5.

Event Action Variables

This section describes event action variables, and contains the following topics:
•
•
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
6-4
Event Actions (continued)
Create any variables that you want to use in event action filters.
Create TVRs.
Assign TVRs to your network assets so that you can calculate the RR.
Create overrides to add actions based on the RR value.
Assign an RR to each event action type.
Create filters.
Assign filters to subtract actions based on the signature's SIGID, IP addresses, and RR.
Configure the general settings.
Specify whether you want to use the summarizer, the meta event generator, or configure denied
attacker parameters.
About Event Action Variables, page 6-5
Configuring Event Action Variables, page 6-5
Description
Starts IP logging packets containing the attacker address.
Starts IP logging packets containing the attacker-victim address pair.
Starts IP logging packets containing the victim address.
Sends TCP resets to hijack and terminate the TCP flow.
Sends request to Notification App to perform SNMP notification.
Sends request to Network Access Controller to block this connection.
Sends request to Network Access Controller to block this host (the
attacker).
Chapter 6 Configuring Event Action Rules
78-16527-01