8-2
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter8 Configuring Event Action Rules
Understanding Security Policies
•
You cannot delete the event action override for deny-packet-inline because it is protected. If you do
not want to use that override, set the override-item-status to disabled for that entry.
•
Passive OS fingerprinting is enabled by default and the IPS contains a default vulnerable OS list for
each signature.
Understanding Security Policies
You can create multiple security policies and apply them to individual virtual sensors. A security policy
is made up of a signature definition policy, an event action rules policy, and an anomaly detection policy.
Cisco IPS contains a default signature definition policy called sig0, a default event action rules policy
called rules0, and a default anomaly detection policy called ad0. You can assign the default policies to
a virtual sensor or you can create new policies. The us e of multiple security policies lets you create
security policies based on different requirements and then apply these customized policies p er VLAN or
physical interface.
Understanding Event Action Rules
Event action rules are a group of settings you configure for the event action processing component of the
sensor. These rules dictate the actions the sensor performs when an event occurs. The event action
processing component is responsible for the following functions:
•
Calculating the risk rating
•
Adding event action overrides
•
Filtering event action
•
Executing the resulting event action
•
Summarizing and aggregating events
•
Maintaining a list of denied attackers
Note
Rate limiting and blocking are not supported for IPv6 traffic. If a signature is configured with a block or
rate limit event action and is triggered by IPv6 traffic, an alert is generated but the action is not carried
out.