Event Store; About Event Store - Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual

Appendix A System Architecture

Event Store

This section describes Event Store, and contains the following topics:
•
•
•

About Event Store

Each IPS event is stored in Event Store with a time stamp and a unique, monotonic, ascending ID. This
time stamp is the primary key used to index the event into the fixed-size, indexed Event Store. When the
circular Event Store has reached its configured size, the oldest event or events are overwritten by the new
event being stored. SensorApp is the only application that writes alert events into the Event Store. All
applications write log, status, and error events into the Event Store.
The fixed-sized, indexed Event Store allows simple event queries based on the time, type, priority, and
a limited number of user-defined attributes. If each event is assigned a priority of low, medium, or high,
a single event query can specify a list of desired event types, intrusion event priorities, and a time range.
Table A-1
Table A-1
IPS Event
Type
status
error
status
status
intrusion
network access
network access
error
status
intrusion
The size of the Event Store allows sufficient buffering of the IPS events when the sensor is not connected
to an IPS event consumer. Sufficient buffering depends on your requirements and the capabilities of the
nodes in use. The oldest events in the circular buffer are replaced by the newest events.
78-16527-01
About Event Store, page A-7
Event Data Structures, page A-8
IPS Events, page A-8
shows some examples:
IPS Event Examples
Intrusion
Event Priority
—
—
—
low
medium
high
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
Start Time Stop Time
Stamp Value Stamp Value
0 Maximum value Get all status events that are
0 65743
65743 Maximum value Get status events that were stored
0 Maximum value Get all intrusion and network
4123000000 4123987256
MainApp
Meaning
stored.
Get all error and status events that
were stored before time 65743.
at or after time 65743.
access events with low priority
that are stored.
Get network access, error, status,
and intrusion events with medium
or high priority that were stored
between time 4123000000 and
4123987256.
A-7