Creating Custom Event Groups - Enterasys Intrusion Prevention System Manual

Creating Custom Event Groups

Creating Custom Event Groups
In the Enterasys IPS Realtime reporting tools, generated events are organized by Event Groups,
which are the same as the names of the Master Libraries. So for example, an AFS:OVERFLOW-
TCPDUMP event will be associated with the ATTACKS Event Group. You can use Event Groups
as one way to filter event reporting. (Refer to "Event Group Descriptions" on page 1-11 for more
information.)
When you create your own custom signature libraries and custom signatures, the events
generated when your custom signatures are matched will be named with the name of your custom
signature and will be assigned to the event group specified during signature configuration. You
may specify a Master Event Group or create and specify a custom Event Group.
In order to create your own custom event group, you must edit the local.conf file located in the
<DRAGON-INSTALL-DIR>/tools directory, following the directions in the file. At each deploy, the
local.conf file is merged with the dragon.conf file, also located in the /tools directory. The files are
also merged at a Live Update.
In order to see your custom event groups in the in the Realtime reporting tools, you may have to
restart the Realtime console.
The following example shows the contents of the local.conf file, followed by an entry in the
local.conf file that adds a custom library named "Custom-Apps" that has four signatures in it. The
library is given a score of 15.
#
# -- local.conf contents --
#
# This file can be used by the customer to input custom
# events which map to custom signatures. For each
# signature library add an entry of the format:
#
# start <Custom Library Name> <score>
# <signatureName1>
# <signatureName2>
# ...
# <signatureNamex>
# stop <Custom Library Name>
#
# where:
#
# <signatureNamex> Name of the custom signature.
# There needs to be an entry for each signature.
# <Custom Library Name> Name of the custom library for signatures.
# <Score> An integer between 0 and 200.
#
# NOTE: The # identifies comment lines. Do not use for actual data.
#
# WARNING: There is no validation of this file, use at
# your own risk.
#
# Copyright 2005 ---- Enterasys
#
# The following lines create a custom event group named Custom-Apps
#
start Custom-Apps 15
IRC:CLIENTINFO4
IRC:CLIENTINFO5
Creating Network Sensor Policies and Signatures 3-43