9-8
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter9 Co nfiguring Anomaly Detection
Enabling Anomaly Detection
For More Information
For the procedure for assigning actions to signatures, see Assigning Ac tions to Signatures, page 7-15.
Enabling Anomaly Detection
To enable anomaly detection, follow these steps:
Step 1
Log in to the CLI using an account with administrator privileges.
Step 2
Enter analysis engine submode.
sensor# configure terminal
sensor(config)# service analysis-engine
sensor(config-ana)#
Step 3
Enter the virtual sensor name that contains the anomaly detec tion policy you want to enable.
sensor(config-ana)# virtual-sensor vs0
sensor(config-ana-vir)#
Step 4
Enable anomaly detection operational mode.
sensor(config-ana-vir)# anomaly-detection
sensor(config-ana-vir-ano)# operational-mode detect
sensor(config-ana-vir-ano)#
Step 5
Exit analysis engine submode.
sensor(config-ana-vir-ano)# exit
sensor(config-ana-vir)# exit
sensor(config-ana-)# exit
Apply Changes:?[yes]:
Step 6
Press Enter to apply your changes or enter
no
to discard them.
Working With Anomaly Detection Policies
Use the service anomaly-detection name command in service anomaly detection submode to create an
anomaly detection policy. The values of this anomaly detection policy are the same as the default
anomaly detection policy, ad0, until you edit them. Or you can use the copy anomaly-detection
source_destination command in privileged EXEC mode to make a copy of an existing policy and then
13008 0 Illegal Other Scanner Identified a single scanner over an Other
protocol in the illegal zone.
13008 1 Illegal Other Scanner Identified a worm attack over an Other
protocol in the illegal zone; the Other
histogram threshold was crossed and a
scanner over an Other protocol was
identified.
Table9-1 Anomaly Detection Worm Signatures (continued)
Signature ID Subsignature ID Name Description