Configuring Target Value Ratings; Event Action Overrides; About Event Action Overrides - Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual

Chapter 6 Configuring Event Action Rules

Configuring Target Value Ratings

You can assign a TVR to your network assets. T he TVR is one of the factors used to calculate the RR
value for each alert. You can assign different TVRs to different targets. Events with a higher RR trigger
more severe signature event actions.
Use the target-value [zero value | low | medium | high | mission-critical] target-address ip_address
range command in service event action rules submode to set TVRs for your network assets. The default
is medium.
To configure TVRs for your network assets, follow these steps:
Log in to the CLI using an account with administrator privileges.
Step 1
Enter event action rules submode:
Step 2
sensor# configure terminal
sensor(config)# service event-action-rules rules0
Step 3 Assign the TVR to the network asset:
sensor(config-rul)# target-value mission-critical target-address 10.89.130.108
Step 4 Check the TVR setting you just configured:
sensor(config-rul)# show settings
-----------------------------------------------
target-value (min: 0, max: 5, current: 1)
-----------------------------------------------
-----------------------------------------------
sensor(config-rul)#
Exit event action rules submode:
Step 5
sensor(config-rul)# exit
Apply Changes:?[yes]:
Press Enter to apply your changes or type
Step 6

Event Action Overrides

This section describes event action overrides, and contains the following topics:
•
•

About Event Action Overrides

You can add an event action override to change the actions associated with an event based on the RR of
that event. Event action overrides are a way to add event actions globally without having to configure
each signature individually. Each event action has an associated RR range. If a signature event occurs
and the RR for that event falls within the range for an event action, that action is added to the event. For
78-16527-01
target-value-setting: mission-critical
target-address: 10.89.130.108 default: 0.0.0.0-255.255.255.255
About Event Action Overrides, page 6-7
Configuring Event Action Overrides, page 6-8
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
to discard them.
no
Configuring Target Value Ratings
6-7