Cisco Systems 2.5 Add or Edit an Event Action Filter

Chapter27 Cisco IOS IPS
Edit IPS
27-34
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Discard Changes
If you want to clear information that you have entered in this window but have not
sent to the router, click Discard Changes. The Discard Changes button is disabled
when there are no changes awaiting delivery to the router.
Add or Edit an Event Action Filter
The following information describes the fields in the Add and the Edit Event
Action Filter dialogs.
Name
SDM provides event action filter names beginning with Q00000, incrementing the
numerical portion of the name by 1 each time you add an event action filter. You
can also enter a name that you choose. If you are editing an event action filter, the
Name field is read-only.
Enabled
Click Yes to enable the event action filter, or click No to disable it. You can also
enable and disable event action filters in the Event Action Filter window.
Signature ID
For Signature ID, enter a range of signature IDs from 900 to 65535, or enter a
single ID in that range. If you enter a range, use a dash (-) to separate the upper
and lower bounds of the range. For example, enter 988-5000.
Subsignature ID
For Subsignature ID, enter a range of subsignature IDs from 0 to 255, or enter a
single subsignature ID in that range. If you enter a range, use a dash (-) to sep arate
the upper and lower bounds of the range. For example, enter 70-200