8-17
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter8 Configuring Event Action Rules
Configuring Event Action Overrides
ipv6-target-value (min: 0, max: 5, current: 0)
-----------------------------------------------
-----------------------------------------------
Step 10
Exit event action rules submode.
sensor(config-rul)# exit
Apply Changes:?[yes]:
Step 11
Press Enter to apply your changes or enter
no
to discard them.
Configuring Event Action Overrides
This section describes event action overrides, and contains the following topics:
•
Understanding Event Action Overrides, page 8-17
•
Adding, Editing, Enabling, and Disabling Event Action Overrides, page 8-17

Understanding Event Action Overrides

You can add an event action override to change the actions associated with an event based on the risk
rating of that event. Event action overrides are a way to add event actions globally without having to
configure each signature individually. Each event action has an associated risk rating range. If a
signature event occurs and the risk rating for that event falls within the range for an event action, that
action is added to the event. For example, if you want any event with a risk rating of 85 or more to
generate an SNMP trap, you can set the risk rating range for reque st-snmp-trap to 85-100. If you do not
want to use action overrides, you can disable the entire event action override component.
Note
Connection blocks and network blocks are not supported on adaptive security appliances . Adaptive
security appliances only support host blocks with additional connection information.

Adding, Editing, Enabling, and Disabling Event Action Overrides

Use the overrides {request-block-connection | request-block-host | deny-attacker-inline |
deny-packet-inline | deny-attacker-service-pair-inline | deny-attacker-victim-pair-inline |
deny-connection-inline | log-attacker-packets | log-victim-packets | log-pair-packets |
reset-tcp-connection | produce-alert | produce-verbose-alert | request-rate-limit |
request-snmp-trap} command in service event action rules submode to configure the parameters of
event action overrides. Use the no overrides command in service event action rules submode to delete
the parameters of event action overrides.
Configure the override event actions, then the risk rating range, then enable or disable the override.
Note
You cannot delete the event action override for deny-packet-inline because it is protected. If you do not
want to use that override, set the override-item-status to disabled for that entry.