Cisco Systems IPS4510K9 Working With Event Action Rules Policies

8-8

Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2

OL-29168-01

Chapter8 Configuring Event Action Rules

Working With Event Action Rules Policies

Create overrides to add actions based on the risk rating value. Assign a risk rating to each event

action type.

Create filters. Assign filters to subtract actions based on the ID, IP addresses, and risk rating of the

signature.

Create OS mappings. OS mappings are used for th e attack relevance rating in the calculation of the

risk rating for an alert.

Configure the general settings. Specify whether you want to use the summarizer, the meta event

generator, or configure denied attacker parameters.

Working With Event Action Rules Policies

Use the service event-action-rules name command in service event action rules submode to create an

event action rules policy. The values of this event action rules policy are the same as the default event

action rules policy, rules0, until you edit them. Or you can use the copy event-action-rules

source_destination command in privileged EXEC mode to make a copy of an existing policy and then

edit the values of the new policy as needed. Use the list event-ac tion-rules-configurations command

in privileged EXEC mode to list the event action rules policies. Use the no service event-action-rules

name command in global configuration mode to delete an event action rules policy. Use the default

service event-action-rules name command in global configuration mode to reset the event action rules

policy to factory settings.

Working With Event Action Rules Policies

To create, copy, display, edit, and delete event action rules policies, follow these steps:

Step 1

Step 2

Create an event action rules policy.

sensor# configure terminal

sensor(config)# service event-action-rules MyRules

sensor(config-eve)# exit

Apply Changes?[yes]: yes

sensor(config)# exit

sensor#

Step 3

Copy an existing event action rules policy to a new event action rules policy.

sensor# copy event-action-rules rules0 rules1

sensor#

Note

You receive an error if the policy already exists or if there is not enough space available for the

new policy.

Step 4

Accept the default event action rules policy values or edit the following parameters.

Add event action rules variables.

Configure event action rules overrides.

Configure event action rules filters.

Configure the event action rules general settings.

Configure the event action rules target value rating.