CHAPT ER
10-1
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
10
Configuring Global Correlation
This chapter provides information for configuring global correlation. It contains the following sections:
•
Global Correlation Notes and Caveats, page 10-1
•
Understanding Global Correlation, page 10-2
•
Participating in the SensorBase Network, page10-2
•
Understanding Reputation, page 10-3
•
Understanding Network Participation, page 10-4
•
Understanding Efficacy, page 10-5
•
Understanding Reputation and Risk Rating, page 10-6
•
Global Correlation Features and Goals, page 10-6
•
Global Correlation Requirements, page 10-7
•
Understanding Global Correlation Sensor Health Metrics, page 10-8
•
Configuring Global Correlation Inspection and Reputation Filtering, page 10-8
•
Configuring Network Participation, page 10-11
•
Troubleshooting Global Correlation, page 10-13
•
Disabling Global Correlation, page 10-13
•
Displaying Global Correlation Statistics, page 10-14

Global Correlation Notes and Caveats

The following notes and caveats apply to configuring global correlation:
•
The global correlation features are supported in IPS 7.0 and later.
•
As with signature updates, when the sensor applies a global correlation update, it may trigger
bypass. Whether or not bypass is triggered depends on the traffic load of the sensor and the size of
the signature/global correlation update. If bypass mode is turned off, an inlin e sensor stops passing
traffic while the update is being applied.
•
Network participation requires a network connection to the Internet.
•
Valid license—You must have a valid sensor license for automatic signature updates and global
correlation features to function. You can still configure and display statistics for the global
correlation features, but the global correlation databases are cleared and no updates are attempted.
Once you install a valid license, the global correlation features are reactivated.