Configuring Event Counter - Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual

Configuring Signatures

Configuring Event Counter

Use the event-counter command in the signature definition submode to configure how the sensor counts
events. For example, you can specify that you want the sensor to send an alert only if the same signature
fires 5 times for the same address set.
The following options apply:
•
•
•
To configure event counter, follow these steps:
Log in to the CLI using an account with administrator or operator privileges.
Step 1
Enter signature definition submode:
Step 2
sensor# configure terminal
sensor(config)# service signature-definition sig0
Choose the signature for which you want to configure event counter:
Step 3
sensor(config-sig)# signatures 9000 0
Enter event counter submode:
Step 4
sensor(config-sig-sig)# event-counter
Configure how many times an event must occur before an alert is generated:
Step 5
sensor(config-sig-sig-eve)# event-count 2
Configure the storage type on which you want to count events for this signature:
Step 6
sensor(config-sig-sig-eve)# event-count-key AxBx
Step 7 (Optional) Enable alert interval:
sensor(config-sig-sig-eve)# specify-alert-interval yes
Step 8 (Optional) Specify the amount of time in seconds before the event count should be reset:
sensor(config-sig-sig-eve-yes)# alert-interval 30
Verify the settings:
Step 9
sensor(config-sig-sig-eve-yes)# exit
sensor(config-sig-sig-eve)# show settings
event-counter
-----------------------------------------------
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
7-8
event-count—The number of times an event must occur before an alert is generated. The valid range
is 1 to 65535. The default is 1.
event-count-key—The storage type on which to count events for this signatures.
Axxx—Attacker address
–
AxBx—Attacker and victim addresses
–
– Axxb—Attacker address and victim port
– xxBx—Victim address
– AaBb—Attacker and victim addresses and ports
specify-alert-interval [yes | no]—Enables alert interval.
alert-interval—The time in seconds before the event count is reset. The default is 60.
–
event-count: 2 default: 1
Chapter 7 Defining Signatures
78-16527-01