Cisco Systems IPS4510K9 manual Understanding Reputation, 1shows how we use the data, 10-3

Chapter 10 Configuring Global Correlation

Understanding Reputation

Table 10-1shows how we use the data.

Table 10-1	Cisco Network Participation Data Use
Participation Level		Type of Data	Purpose
Partial		Protocol attributes	Tracks potential threats and helps us to
		(TCP maximum segment size and	understand threat exposure.
		options string, for example)
		Attack type	Used to understand current attacks and
		(signature fired and risk rating, for	attack severity.
		example)
		Connecting IP address and port	Identifies attack source.
		Summary IPS performance	Tracks product efficacy.
		(CPU utilization, memory usage,
		inline vs. promiscuous, for
		example)
Full		Victim IP address and port	Detects threat behavioral patterns.

When you enable Partial or Full Network Participation, the Network Participation Disclaimer appears. You must enter yes to participate. If you do not have a license installed, you receive a warning telling you that global correlation inspection and reputation filtering are disabled until the sensor is licensed. You can obtain a license at http://www.cisco.com/go/license.

For More Information

For information on how to obtain and install a sensor license, see Installing the License Key, page 3-54.

Understanding Reputation

Similar to human social interaction, reputation is an opinion toward a device on the Internet. It enables the installed base of IPS sensors in the field to collaborate using the existing network infrastructure. A network device with reputation is most likely either malicious or infected. You can view reputation information and statistics in the IDM, IME, or the CLI.

The IPS sensor collaborates with the global correlation servers (also known as reputation servers) to improve the efficacy of the sensor.

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		10-3