10-6
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter10 Co nfiguring Global Correlation
Understanding Reputation and Risk Rating
Understanding Reputation and Risk Rating
Risk rating is the concept of the probability that a network event is malicious. You assign a numerical
quantification of the risk associated with a particular event on the network. By default, an alert with an
extreme risk rating shuts down traffic. Reputation indicates the probability that a particular attacker IP
address will initiate malicious behavior based on its known past activity. A certain score is computed for
this reputation by the Alarm Channel and added to risk rating, thus improving the efficacy of the IPS.
When the attacker has a bad reputation score, an incremental risk is added to the risk rating to make it
more aggressive.
The Alarm Channel handles signature events from the data path. The alert processing units have multiple
aggregation techniques, action overrides, action filters, attacker reputation, and per-action custom
handling methods. We use the large reputation data from the reputation participation client to score
attackers in the Alarm Channel and then use this score to influence the risk rating and actions of the alert.
For More Information
•
For a detailed description of risk rating, see Calculating the Risk Rating, page 8-13.
•
For a detailed description of threat rating, see Understanding Threat Rating, page 8-14.
•
For a detailed description of event action filters, see Configuring Event Action Filters, page 8-20.
•
For a detailed description of the Alarm Channel, see Understanding the SensorApp, page A-23.
•
For a detailed description of event action aggregation, see Understanding Event Action Aggregation,
page 8-33.
Global Correlation Features and Goals
There are three main features of global correlation:
•
Global Correlation Inspection—We use the global correlation reputation knowledge of attackers to
influence alert handling and deny actions when attackers with a bad score are seen on the sensor.
•
Reputation Filtering—Applies automatic deny actions to packets from known malicious sites.
•
Network Reputation—Sensor sends alert and TCP fingerprint data to the SensorBase Network.
Global correlation has the following goals:
•
Dealing intelligently with alerts thus improving efficacy.
•
Improving protection against known malicious sites.
•
Sharing telemetry data with the SensorBase Network to improve visibility of alerts and sensor
actions on a global scale.
•
Simplifying configuration settings.
•
Automatic handling of the uploads and downloads of the information.