8-5
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter8 Configuring Event Action Rules
Event Actions
Note
There are other event actions that force a produce-alert. These actions use produce-alert as
the vehicle for performing the action. Even if produce-alert is not selected or is filtered, the
alert is still produced. The actions are the following: produce-verbose-alert,
request-snmp-trap, log-attacker-packets, log-victim-packets, and log-pair-packets.
Note
A produce-alert event action is added for an event when global correlation has increased the
risk rating of an event, and has added either the deny-packet-inline or deny-attacker-inline
event action.
•
produce-verbose-alert—Includes an encoded dump of the offending packet in the alert. This action
causes an alert to be written to the Event Store, even if produce-alert is not selected.
•
log-attacker-packets—Starts IP logging on packets that contain the attacker address and sends an
alert. This action causes an alert to be written to the Event Store, even if produce-alert is not
selected.
•
log-victim-packets—Starts IP logging on packets that contain the victim address and sends an alert.
This action causes an alert to be written to the Event Store, even if produce-alert is not selected.
•
log-pair-packets—Starts IP logging on packets that contain the attacker/victim address pa ir. This
action causes an alert to be written to the Event Store, even if produce-alert is not selected.
•
request-snmp-trap—Sends a request to the Notification Application component of the sensor to
perform SNMP notification. This action causes an alert to be written to the Event Store, even if
produce-alert is not selected. You must have SNMP configured on the sensor to implement this
action.
Deny Actions
•
deny-packet-inline (inline only)—Terminates the packet.
Note
You cannot delete the event action override for deny-packet-inline because it is protected. If
you do not want to use that override, set the override-item-status to disabled for that entry.
•
deny-connection-inline (inline only)—Terminates the current packet and future packets on this TCP
flow.
•
deny-attacker-victim-pair-inline (inline only)—Does not transmit this packet and future packets on
the attacker/victim address pair for a specified period of time.
•
deny-attacker-service-pair-inline (inline only)—Does not transmit this packet and future packets on
the attacker address victim port pair for a specified period of time.
•
deny-attacker-inline (inline only)—Terminates the current packet and future packets from this
attacker address for a specified period of time.
The sensor maintains a list of attackers being denied by the system. To remove an entry from the
denied attacker list, you can view the list of attackers and clear the entire list, or you can wait for
the timer to expire. The timer is a sliding timer for each entry. Therefore, if attacker A is being
denied, but issues another attack, the timer for attacker A is reset and attacker A remains in the
denied attacker list until the timer expires. If the denied attacker list is at capacity and cannot add a
new entry, the packet is still denied.
•
modify-packet-inline (inline only)—Modifies packet data to remove ambiguity about what the end
point might do with the packet.