Cisco ROUTER-SDM-CD User Manual page 653

Chapter 27 Cisco IOS IPS
Note
Discard Changes Button
Note
Victim Port
Risk Rating
Actions to Subtract
Stop on Match
Comments
OL-4015-12
If you are attempting to import signatures, and these signatures are all identical to
deployed signatures, then the Apply Changes button is disabled.
Click to discard accumulated changes.
If you are attempting to import signatures, and these signatures are all identical to
deployed signatures, then the Discard Changes button is disabled.
For Victim Port, enter a range of port numbers from 0 to 65535, or enter a single
port number in that range. If you enter a range, use a dash (-) to separate the upper
and lower bounds of the range. For example, enter 988-5000.
For Risk Rating, nter an
Click any actions that you want to subtract from matching events. To subtract
more than one action from matching events, hold down the Ctrl key when you
choose additional events. All the events that you choose for this filter will be listed
in the Event Action Filters window.
If you want the Cisco IOS IPS to stop when an event matches this event action
filter, click Yes. If you want the Cisco IOS IPS to evaluate matching events against
the other remaining filters, click No.
You can add comments to describe the purpose of this filter. This field is optional.
Cisco Router and Security Device Manager 2.5 User's Guide
RR range between 0 and 100.
Edit IPS
27-41