8-33
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter8 Configuring Event Action Rules
Configuring General Settings
•
Configuring the General Settings, page 8-34
Understanding Event Action Summarization
Summarization decreases the volume of alerts sent out from the sensor by providing basic aggregation
of events into a single alert. Special parameters are specified for each signature and they influence the
handling of the alerts. Each signature is created with defaults that reflect a preferred norm al behavior.
However, you can tune each signature to change this default behavior within the constraints for each
engine type.
The nonalert-generating actions (deny, block, TCP reset) go through the filters for each signature event
unsummarized. The alert-generating actions are not performed on these summarized alerts; instead the
actions are applied to the one summary alert and then put through the filters.
If you select one of the other alert-generating actions and do not have it filtered out, the alert is created
even if you do not select produce-alert. To prevent alerts from being created, you must have all
alert-generating actions filtered out.
Summarization and event actions are processed after the Meta engine has processed the component
events. This lets the sensor watch for suspicious activity transpiring over a series of events.
Understanding Event Action Aggregation
Basic aggregation provides two operating m odes. The simple mode involves configuring a threshold
number of hits for a signature that must be met before the alert is sent. A more advanced mode is
timed-interval counting. In this mode, the sensor tracks the number of hits per second and only sends
alerts when that threshold is met. In this example, a hit is a term used to describe an event, which is
basically an alert, but it is not sent out of the sensor as an alert until the threshold number of hits has
been exceeded.
You can choose from the following summarization options:
•
fire-all—Fires an alert each time the signature is triggered. If the threshold is set for summarization,
alerts are fired for each execution until summarization occurs. After summarization starts, only one
alert every summary interval fires for each address set. Alerts for other address sets are either all
seen or separately summarized. The signature reverts to fire all mode after a period of no alerts for
that signature.
•
summary—Fires an alert the first time a signature is triggered, and then additional alerts for that
signature are summarized for the duration of th e summary interval. Only one alert every summary
interval should fire for each address set. If the global summary threshold is reached, the signature
goes into global summarization mode.
•
global-summarization—Fires an alert for every summary interval. Signatures can be preconfigured
for global summarization.
•
fire-once—Fires an alert for each address set. You can upgrade this mode to global summarization
mode.