Cisco Systems IPS4510K9 Configuring Event Action Overrides, Understanding Event Action Overrides

Chapter 8 Configuring Event Action Rules

Configuring Event Action Overrides

ipv6-target-value (min: 0, max: 5, current: 0)

-----------------------------------------------

-----------------------------------------------

Step 10 Exit event action rules submode.

sensor(config-rul)# exit

Apply Changes:?[yes]:

Step 11 Press Enter to apply your changes or enter no to discard them.

Configuring Event Action Overrides

This section describes event action overrides, and contains the following topics:

•Understanding Event Action Overrides, page 8-17

•Adding, Editing, Enabling, and Disabling Event Action Overrides, page 8-17

Understanding Event Action Overrides

You can add an event action override to change the actions associated with an event based on the risk rating of that event. Event action overrides are a way to add event actions globally without having to configure each signature individually. Each event action has an associated risk rating range. If a signature event occurs and the risk rating for that event falls within the range for an event action, that action is added to the event. For example, if you want any event with a risk rating of 85 or more to generate an SNMP trap, you can set the risk rating range for request-snmp-trap to 85-100. If you do not want to use action overrides, you can disable the entire event action override component.

Note Connection blocks and network blocks are not supported on adaptive security appliances. Adaptive security appliances only support host blocks with additional connection information.

Adding, Editing, Enabling, and Disabling Event Action Overrides

Use the overrides {request-block-connection request-block-host deny-attacker-inline deny-packet-inline deny-attacker-service-pair-inline deny-attacker-victim-pair-inline deny-connection-inline log-attacker-packets log-victim-packets log-pair-packets reset-tcp-connection produce-alert produce-verbose-alert request-rate-limit request-snmp-trap} command in service event action rules submode to configure the parameters of event action overrides. Use the no overrides command in service event action rules submode to delete the parameters of event action overrides.

Configure the override event actions, then the risk rating range, then enable or disable the override.

Note You cannot delete the event action override for deny-packet-inline because it is protected. If you do not want to use that override, set the override-item-status to disabled for that entry.

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		8-17