10-12
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter10 Co nfiguring Global Correlation
Configuring Network Participation
Note
You must accept the network participation disclaimer to turn on network participation.

Turning on Network Participation

To turn on network participation, follow these steps:
Step 1
Log in to the CLI using an account with administrator privileges.
Step 2
Enter global correlation submode.
sensor# configure terminal
sensor(config)# service global-correlation
sensor(config-glo)#
Step 3
Turn on network participation.
sensor(config-glo)# network-participation [full | partial]
sensor(config-glo)# exit
Step 4
Enter
yes
to agree to participate in the SensorBase Network.
If you agree to participate in the SensorBase Network, Cisco will collect aggregated
statistics about traffic sent to your IPS. This includes summary data on the Cisco IPS
network traffic properties and how this traffic was handled by the Cisco appliances. We do
not collect the data content of traffic or other sensitive business or personal
information. All data is aggregated and sent via secure HTTP to the Cisco SensorBase
Network servers in periodic intervals. All data shared with Cisco will be anonymous and
treated as strictly confidential.
The table below describes how the data will be used by Cisco.
Participation Level = "Partial":
* Type of Data: Protocol Attributes (e.g. TCP max segment size and
options string)
Purpose: Track potential threats and understand threat exposure
* Type of Data: Attack Type (e.g. Signature Fired and Risk Rating)
Purpose: Used to understand current attacks and attack severity
* Type of Data: Connecting IP Address and port
Purpose: Identifies attack source
* Type of Data: Summary IPS performance (CPU utilization memory usage,
inline vs. promiscuous, etc)
Purpose: Tracks product efficacy
Participation Level = "Full" additionally includes:
* Type of Data: Victim IP Address and port
Purpose: Detect threat behavioral patterns
Do you agree to participate in the SensorBase Network?[no]:
Step 5
Verify the settings.
sensor(config-glo)# show settings
network-participation: full default: off
global-correlation-inspection: on default: on
global-correlation-inspection-influence: aggressive default: standard
reputation-filtering: on default: on
test-global-correlation: on default: off
sensor(config-glo)#
Step 6
Exit global correlation submode.
sensor(config-glo)# exit
Apply Changes:?[yes]: