Cisco Systems IPS4510K9 manual Working With Event Action Rules Policies

Chapter 8 Configuring Event Action Rules

Working With Event Action Rules Policies

3.Create overrides to add actions based on the risk rating value. Assign a risk rating to each event action type.

4.Create filters. Assign filters to subtract actions based on the ID, IP addresses, and risk rating of the signature.

5.Create OS mappings. OS mappings are used for the attack relevance rating in the calculation of the risk rating for an alert.

6.Configure the general settings. Specify whether you want to use the summarizer, the meta event generator, or configure denied attacker parameters.

Working With Event Action Rules Policies

Use the service event-action-rulesname command in service event action rules submode to create an event action rules policy. The values of this event action rules policy are the same as the default event action rules policy, rules0, until you edit them. Or you can use the copy event-action-rulessource_destination command in privileged EXEC mode to make a copy of an existing policy and then edit the values of the new policy as needed. Use the list event-action-rules-configurationscommand in privileged EXEC mode to list the event action rules policies. Use the no service event-action-rulesname command in global configuration mode to delete an event action rules policy. Use the default service event-action-rulesname command in global configuration mode to reset the event action rules policy to factory settings.

Working With Event Action Rules Policies

To create, copy, display, edit, and delete event action rules policies, follow these steps:

Step 1 Log in to the CLI using an account with administrator privileges.

Step 2 Create an event action rules policy.

sensor# configure terminal

sensor(config)# service event-action-rules MyRules

sensor(config-eve)# exit

Apply Changes?[yes]: yes sensor(config)# exit sensor#

Step 3 Copy an existing event action rules policy to a new event action rules policy.

sensor# copy event-action-rules rules0 rules1

sensor#

Note You receive an error if the policy already exists or if there is not enough space available for the new policy.

Step 4 Accept the default event action rules policy values or edit the following parameters.

a.Add event action rules variables.

b.Configure event action rules overrides.

c.Configure event action rules filters.

d.Configure the event action rules general settings.

e.Configure the event action rules target value rating.

Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2

8-8 OL-29168-01