8-27
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter8 Configuring Event Action Rules
Configuring OS Identifications
There are three sources of OS information. The sensor ranks the sources of OS information in the
following order:
1.
Configured OS maps—OS maps you enter. Configured OS maps reside in the event action rules
policy and can apply to one or many virtual sensors.
Note
You can specify multiple operating systems for the same IP address. The last one in the list
is the operating system that is matched.
2.
Imported OS maps—OS maps imported from an external data source. Imported OS maps a re global
and apply to all virtual sensors.
Note
Currently the CSA MC is the only external data source.
3.
Learned OS maps—OS maps observed by the sensor through the fingerprinting of TCP packets with
the SYN control bit set. Learned OS maps are local to the virtual sensor that sees the traffic.
When the sensor needs to determine the OS for a target IP address, it consults the configured OS maps.
If the target IP address is not in the configured OS maps, the sensor looks in the imported OS maps. If
the target IP address is not in the imported OS maps, the sensor looks in the learned OS maps. If it cannot
find it there, the sensor treats the OS of the target IP address as unknown.
Note
Passive OS fingerprinting is enabled by default and the IPS contains a default vulnerable OS list for each
signature.
Passive OS Fingerprinting Configuration Considerations
You do not have to configure passive OS fingerprinting for it to function. IPS provides a default
vulnerable OS list for each signature and passive analysis is enabled by default.
You can configure the following aspects of passive OS fingerprinting:
•
Define OS maps—We recommend configuring OS maps to define the identity of the OS running on
critical systems. It is best to configure OS maps when the OS and IP address of the critical systems
are unlikely to change.
•
Limit the attack relevance rating calculation to a specific IP address range—This limits the attack
relevance rating calculations to IP addresses on the protected network.
•
Import OS maps—Importing OS maps provides a mechan ism for accelerating the learning rate and
fidelity of the OS identifications made through passive analysis. If you have an external product
interface, such as the CSA MC, you can import OS identifications from it.
•
Define event action rules filters using the OS relevance value of the target—This provides a way to
filter alerts solely on OS relevance.
•
Disable passive analysis—Stops the sensor from learning new OS maps.
•
Edit signature vulnerable OS lists—The vulnerable OS list specifies what OS types are vulnerable
to each signature. The default, general-os, applies to all signatures that do not specify a vulnerable
OS list.