8-26
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter8 Configuring Event Action Rules
Configuring OS Identifications
Step 12
Exit event action rules submode.
sensor(config-eve)# exit
Apply Changes:?[yes]:
Step 13
Press Enter to apply your changes or enter
no
to discard them.
For More Information
For the procedure for configuring event action variables, see Adding, Editing, and Deleting Event Action
Variables, page8-11 .
Configuring OS Identifications
This section describes OS identifications and how to configure OS maps, and contains the following
topics:
•
Understanding Passive OS Fingerprinting, page 8-26
•
Passive OS Fingerprinting Configuration Considerations, page 8-27
•
Adding, Editing, Deleting, and Moving Configured OS Maps, page 8-28
•
Displaying and Clearing OS Identifications, page8-31

Understanding Passive OS Fingerprinting

Passive OS fingerprinting lets the sensor determine the OS that hosts are running. The sensor analyzes
network traffic between hosts and stores the OS of these hosts with their IP addresses. The sensor
inspects TCP SYN and SYNACK packets exchanged on the network to determine the OS type.
The sensor then uses the OS of the target host OS to determine the relevance of the attack to the victim
by computing the attack relevance rating component of the risk ra ting. Based on the relevance of the
attack, the sensor may alter the risk rating of the alert for the attack and/or the sensor may filter the alert
for the attack. You can then use the risk rating to reduce the number of false positive alerts (a benefit in
IDS mode) or definitively drop suspicious packets (a benefit in IPS mode). Passive OS fingerprinting
also enhances the alert output by reporting the victim OS, the source of the OS identification, and the
relevance to the victim OS in the alert.
Passive OS fingerprinting consists of three components:
•
Passive OS learning—Passive OS learning occurs as the sensor observes traffic on the network.
Based on the characteristics of TCP SYN and SYNACK packets, the sensor makes a determination
of the OS running on the host of the source IP address.
•
User-configurable OS identification—You can configure OS host maps, which take precedence over
learned OS maps.
•
Computation of attack relevance rating and risk rating—The sensor uses OS information to
determine the relevance of the attack signature to the targeted host. The attack relevance is the attack
relevance rating component of the risk rating value for the attack alert. The sensor uses the OS type
reported in the host posture information imported from the CSA MC to compute the attack relevance
rating.