Cisco Systems IPS4510K9 manual Working With Anomaly Detection Policies

Chapter 9 Configuring Anomaly Detection

Working With Anomaly Detection Policies

edit the values of the new policy as needed. Use the list anomaly-detection-configurationscommand in privileged EXEC mode to list the anomaly detection policies. Use the no service anomaly-detectionname command in global configuration mode to delete an anomaly detection policy. Use the default service anomaly-detectionname command in global configuration mode to reset the anomaly detection policy to factory settings.

Working With Anomaly Detection Policies

To create, copy, display, edit, and delete anomaly detection policies, follow these steps:

Step 1 Log in to the CLI using an account with administrator privileges.

Step 2 Create an anomaly detection policy.

sensor# configure terminal

sensor(config)# service anomaly-detection MyAnomaly Detection

Editing new instance MyAnomaly Detection. sensor(config-ano)# exit

Apply Changes?[yes]: yes

sensor(config)# exit sensor#

Step 3 Or copy an existing anomaly detection policy to a new anomaly detection policy.

sensor# copy anomaly-detection ad0 ad1

sensor#

Note You receive an error if the policy already exists or if there is not enough space available for the new policy.

Step 4 Accept the default anomaly detection policy values or edit the following parameters:

a.Configure the operational settings.

b.Configure the zones.

c.Configure learning accept mode.

d.Learn how to work with KBs.

Step 5 Display a list of anomaly detection policies on the sensor.

sensor#	list anomaly-detection-configurations
Anomaly	Detection
Instance		Size	Virtual Sensor
ad0		255	vs0
temp		707	N/A
MyAnomaly Detection				255	N/A
ad1		141	vs1
sensor#

Step 6 Delete an anomaly detection policy.

sensor# configure terminal

sensor(config)# no service anomaly-detection MyAnomaly Detection

sensor(config)# exit

sensor#

Note You cannot delete the default anomaly detection policy, ad0.

Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2

OL-29168-01 9-9