Cisco Systems IPS4510K9 manual Configuring Event Action Filters

Chapter 8 Configuring Event Action Rules

Configuring Event Action Filters

Caution Event action filters based on source and destination IP addresses do not function for the Sweep engine, because they do not filter as regular signatures. To filter source and destination IP addresses in sweep alerts, use the source and destination IP address filter parameters in the Sweep engine signatures.

Configuring Event Action Filters

Note Global correlation inspection and the reputation filtering deny features do not support IPv6 addresses. For global correlation inspection, the sensor does not receive or process reputation data for IPv6 addresses. The risk rating for IPv6 addresses is not modified for global correlation inspection. Similarly, network participation does not include event data for attacks from IPv6 addresses. And finally, IPv6 addresses do not appear in the deny list.

Note Rate limiting and blocking are not supported for IPv6 traffic. If a signature is configured with a block or rate limit event action and is triggered by IPv6 traffic, an alert is generated but the action is not carried out.

You can configure event action filters to remove specific actions from an event or to discard an entire event and prevent further processing by the sensor. You can use event action variables that you defined to group addresses for your filters.

Note You must preface the event variable with a dollar sign ($) to indicate that you are using a variable rather than a string. Otherwise, you receive the Bad source and destination error.

Use the filters {edit insert move] name1 [begin end inactive before after} command in service event action rules submode to set up event action filters.

The following options apply:

•actions-to-remove—Specifies the event actions to remove for this filter item.

•attacker-address-range—Specifies the range set of IPv4 attacker address(es) for this item (for example, 192.0.2.0-192.0.2.254,192.3.2.0-192.3.2.254).

Note The second IP address in the range must be greater then or equal to the first IP address. If you do not specify an attacker address range, all IPv4 attacker addresses are matched.

•attacker-port-range—Specifies the range set of attacker port(s) for this item (for example, 147-147,8000-10000).

•default—Sets the value back to the system default setting.

•deny-attacker-percentage—Specifies the percentage of packets to deny for deny attacker features. The valid range is 0 to 100. The default is 100.

•filter-item-status{enabled disabled}—Enables or disables the use of this filter item.

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		8-21