Cisco ROUTER-SDM-CD User Manual page 659

Chapter 27 Cisco IOS IPS
Subsignature ID
Alert Severity
Sig Fidelity Rating
Promiscuous Delta
Note
Sig Description
Engine
OL-4015-12
The unique numerical value assigned to this subsignature. A subsignature ID is
used to identify a more granular version of a broad signature.
Choose one of the following to categorize the severity of the alert: High, Medium,
Low, or Informational.
The signature fidelity rating is a value set by the author of the signature to quantify
the confidence that the signature will produce true positives. This value is set
before a signature is deployed and can be adjusted when signature performance
data is available.
The promiscuous delta is a factor that is subtracted from the risk rating (RR) of
an event when the router is operating in promiscuous mode. The Promiscuous
Delta is subtracted from the RR every time an alert is triggered when the system
is deployed in promiscuous mode.
Even though the promiscuous delta can be reconfigured on a signature basis, it is
not recommended that you change any of the predefined promiscuous-delta
settings.
The signature description includes the signature name and release, any alert notes
available from the Cisco Security
The signature engine associated with this signature. One commonly-used engine
is named Atomic IP.
Cisco Router and Security Device Manager 2.5 User's Guide
Center, user comments, and other information.
Edit IPS
27-47