Cisco Systems 2.5 Add Target Value Rating, Edit IPS: SEAP Configuration: Event Action Overrides

27-29
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Chapter27 Cisco IOS IPS
Edit IPS
Discard Changes
To clear information that you have entered in the Target Value Rating window but
have not sent to the router, click Discard Changes. The Discard Changes button
is disabled when there are no changes made that are awaiting delivery to the
router.
Add Target Value Rating
To add a TVR entry, choose the target value rating and enter a Target IP Address
or range of IP addresses.
Target Value Rating (TVR)
Targets can be rated as High, Low, Medium, Mission Critical, or No Value. Once
a rating has been used for one target entry, it cannot be used for additional entries.
Therefore, enter into the same entry all the targets that you want to give the same
rating.
Target IP Addresses
You can enter a single target IP address or a range of addresses, as shown in the
examples that follow:
192.168.22.33
10.10.11.4-10.10.11.55
The IP addresses that you enter are displayed in the Target Value Rating window.
Edit IPS: SEAP Configuration: Event Action Overrides
Event action overrides allow you to change the actions associated with an event
based on the Risk Rating RR of that event. You do this by assigning an RR range
for each event action. If an event occurs and its RR falls within the range that you
defined, the action is added to the event. Event action overrides are a way to add
event actions globally without having to configure each signature individually.