8-13
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter8 Configuring Event Action Rules
Configuring Target Value Ratings
Configuring Target Value Ratings
This section describes what risk rating is and how to use it to configure target value ratings. This section
contains the following topics:
•
Calculating the Risk Rating, page 8-13
•
Understanding Threat Rating, page8-14
•
Adding, Editing, and Deleting Target Value Ratings, page8-15

Calculating the Risk Rating

A risk rating (RR) is a value between 0 and 100 that represents a nu merical quantification of the risk
associated with a particular event on the network. The calculation takes into account the value of the
network asset being attacked (for example, a particular server), so it is configured on a per-signature
basis using the attack severity rating and the signature fidelity rating, and on a per-server basis using the
target value rating. The risk rating is calculated from several components, some of which are configured,
some collected, and some derived.
Note
The risk rating is associated with alerts not signatures.
Risk ratings let you prioritize alerts that need your attention. These risk rating factors take into
consideration the severity of the attack if it succeeds, the fidelity of the signature, the reputation score
of the attacker from the global correlation data, and the overall value of the target host to you. The risk
rating is reported in the evIdsAlert.
The following values are used to calculate the risk rating for a particular event:
•
Signature fidelity rating (SFR)—A weight associated with how well this signature might perform in
the absence of specific knowledge of the target. The signature fidelity rating is configured per
signature and indicates how accurately the signature detects the event or condition it describes.
Signature fidelity rating is calculated by the signature author on a per-signature basis. The signature
author defines a baseline confidence ranking for the accuracy of the signature in the absence of
qualifying intelligence on the target. It represents the confidence that the detected behavior would
produce the intended effect on the target platform if the packet under analysis were allowed to be
delivered. For example, a signature that is written with very specific rules (specific regular
expression) has a higher signature fidelity rating than a signature that is written with generic rules.
Note
The signature fidelity rating does not indicate how bad the detected event may be.
•
Attack severity rating (ASR)—A weight associated with the severity of a successful exploit of the
vulnerability. The attack severity rating is derived from the alert severity parameter (informational,
low, medium, or high) of the signature. The attack severity rating is configured per signature and
indicates how dangerous the event detected is.
Note
The attack severity rating does not indicate how accurately the event is detected.