Cisco Systems IPS4510K9 Configuring Learning Accept Mode

9-38
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter9 Co nfiguring Anomaly Detection
Configuring Learning Accept Mode
Configuring Learning Accept Mode
Use the learning-accept-mode command in service anomaly detection submode to configure whether
you want the sensor to create a new KB every so many hours. You can configure whether the KB is
created and loaded (rotate) or saved (save only). You can schedule how often and when the KB is loaded
or saved.
The new updated KB file name is the current date and time, YYYY-Mon-dd-hh_mm_ss, where Mon is the
three-letter abbreviation of the month.
Note Anomaly detection learning accept mode uses the sensor local time.
The following options apply:
• learning-accept-mode—Specifies if and when the KB is saved and loaded:
– auto— Configures the sensor to automatically accept the KB.
– manual—Does not save the KB.
Note You can save and load the KB using the anomaly-detection {load | save} commands.
• action—Specifies whether to rotate or save the KB:
– save-only—Saves the new KB. You can examine it and decide whether to load it into anomaly
detection.
Note You can load the KB using the anomaly-detection load command.
– rotate—Saves the new KB and loads it as the current KB according to the schedule you define.
• schedule— Configures a schedule to accept the KB:
– calendar-schedule {days-of-week} {times-of-day}—Starts learning accept mode at specific
times on specific days.
– periodic-schedule {interval} {start-time}—Starts learning accept mode at specific periodic
intervals.
Configuring Learning Accept Mode
The first saving begins after a full interval between configuration time and start time. For example, if the
time is now 16:00 and you configure start time at 16:30 with an interval of one hour, the first KB is saved
at 17:30, because there was no one-hour interval between 16:00 and 16:30.
To configure learning accept mode, follow these steps:
Step 1 Log in to the CLI using an account with administrator privileges.
Step 2 Enter anomaly detection submode.
sensor# configure terminal
sensor(config)# service anomaly-detection ad1