9-5
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter9 Configuring Anomaly Detection
Anomaly Detection Configuration Sequence
Anomaly Detection Configuration Sequence
You can configure the detection part of anomaly detection. You can configure a set of thresholds that
override the KB learned thresholds. However, anomaly detection continues learning regardless of how
you configure the detection. You can also import, export, and load a KB and you can view a KB for data.
Follow this sequence when configuring anomaly detection:
1.
Create an anomaly detection policy to add to the virtual sensors. Or you can use the default anomaly
detection policy, ad0.
2.
Add the anomaly detection policy to your virtual sensors.
3.
Enable anomaly detection.
4.
Configure the anomaly detection zones and protocols.
5.
For the first 24 hours anomaly detection performs learning to create a populated KB. The initial KB
is empty and during the default 24 hours, anomaly detection collects data to use to populate the KB.
If you want the learning period to be longer than the default period of 24 hou rs, you must manually
set the mode to learning accept.
6.
Let the sensor run in learning accept mode for at least 24 hours (the default). You should let the
sensor run in learning accept mode for at least 24 hours so it can gather information o n the normal
state of the network for the initial KB. However, you should change the amount of time for learning
accept mode according to the complexity of your network. After the time period, the sensor saves
the initial KB as a baseline of the normal activity of your network.
Note
We recommend leaving the sensor in learning accept mode for at least 24 hours, but letting
the sensor run in learning accept mode for longer, even up to a week, is better.
7.
If you manually set anomaly detection to learning accept mode, switch back to detect mode.
8.
Configure the anomaly detection parameters:
•
Configure the worm timeout and which source and destination IP addresses should be bypassed
by anomaly detection. After this timeout, the scanner threshold returns to the configured value.
•
Decide whether you want to enable automatic KB updates when anomaly detection is in detect
mode.
•
Configure the 18 anomaly detection worm signatures to have more event actions than just the
default produce-alert. For example, configure them to have deny-attacker event actions.
For More Information
•
For the procedures for putting anomaly detection in different modes, see Adding, Editing, and
Deleting Virtual Sensors, page 5-4.
•
For the procedure for configuring a new anomaly detection policy, see Working With Anomaly
Detection Policies, page 9-8.
•
For more information on configuring zones, see Configuring the Internal Zone, page 9-11,
Configuring the Illegal Zone, page 9-20, and Configuring the External Zone, page 9-28.
•
For more information on anomaly detection modes, see Anomaly Detection Modes, page 9-3.
•
For more information about configuring learning accept mode, see Configuring Learning Accept
Mode, page 9-36.