Cisco Systems IPS4510K9 Adding, Editing, and Deleting Event Action Variables

8-11
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter8 Configuring Event Action Rules
Event Action Variables
Timesaver If you have an IP address space that applies to your engineering group and there are no Windows systems
in that group, and you are not worried about any Windows-based attacks to that gro up, you could set up
a variable to be the IP address space of the engineering group. You could then use this variable to
configure a filter that would ignore all Windows-based attacks for this group.
Adding, Editing, and Deleting Event Action Variables
Note Global correlation inspection and the reputation filtering deny features do not support IPv6 addresses.
For global correlation inspection, the sensor does not receive or process reputation data for IPv6
addresses. The risk rating for IPv6 addresses is not modified for global co rrelation inspection. Similarly,
network participation does not include event data for attacks from IPv6 addresses. And finally, IPv6
addresses do not appear in the deny list.
Note Rate limiting and blocking are not supported for IPv6 traffic. If a signature is configured with a block or
rate limit event action and is triggered by IPv6 traffic, an alert is generated but the action is not carried
out.
Use the variables variable_name address ip_address command in service event action rules submode
to create an IPv4 event action variable. The IPv4 address can be one address, a range, or range s separated
by a comma. Use the variables variab le_name ipv6-address ip_address command in service event
action rules submode to create an IPv6 event action variable. Use the no variables variable_name
command in service event action rules submode to delete an event action variable.
Note IPv6 addresses are 128 bits represented in hexadecimal and divided into eight 16-bit groups separated
by colons. You can skip the leading zeros and you can represent the zeroed groups in the middle with a
double colon (::). You must start the address with the 2001:db8 prefix.
Working With Event Action Variables
To add, delete, and edit event action variables, follow these steps:
Step 1 Log in to the CLI using an account with administrator privileges.
Step 2 Enter event action rules submode.
sensor# configure terminal
sensor(config)# service event-action-rules rules0
Step 3 Add an IPv4 event action rules variable. The valid values for address are A.B.C.D-A.B.C.D
[,A.B.C.D-A.B.C.D].
sensor(config-eve)# variables variable-ipv4 address 192.0.2.3
Step 4 Add an IPv6 event action rules variable. The valid form for ipv6-address is:
<XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX>-<XXXX:XXXX:XXXX:XXXX:XX
XX:XXXX:XXXX:XXXX>[,<XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX>-<XXX
X:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX>]