Add Target Value Rating; Edit Ips: Seap Configuration: Event Action Overrides - Cisco ROUTER-SDM-CD User Manual

Chapter 27 Cisco IOS IPS
Discard Changes

Add Target Value Rating

Target Value Rating (TVR)
Target IP Addresses

Edit IPS: SEAP Configuration: Event Action Overrides

OL-4015-12
To clear information that you have entered in the Target Value Rating window but
have not sent to the router, click Discard Changes. The Discard Changes button
is disabled when there are no changes made that are awaiting delivery to the
router.
To add a TVR entry, choose the target value rating and enter a Target IP Address
or range of IP addresses.
Targets can be rated as High, Low, Medium, Mission Critical, or No Value. Once
a rating has been used for one target entry, it cannot be used for additional entries.
Therefore, enter into the same entry all the targets that you want to give the same
rating.
You can enter a single target IP address or a range of addresses, as shown in the
examples that follow:
192.168.22.33
10.10.11.4-10.10.11.55
The IP addresses that you enter are displayed in the Target Value Rating window.
Event action overrides allow you to change the actions associated with an event
based on the Risk Rating
for each event action. If an event occurs and its RR falls within the range that you
defined, the action is added to the event. Event action overrides are a way to add
event actions globally without having to configure each signature individually.
Cisco Router and Security Device Manager 2.5 User's Guide
RR of that event. You do this by assigning an RR range
Edit IPS
27-29