1-8
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter1 In troducing the CLI Configuration Guide
IPS Command Modes
IPS Command Modes
The Cisco IPS CLI has the following command modes:
•
privileged EXEC—Entered when you log in to the CLI interface.
•
global configuration—Entered from privileged EXEC mode by entering
configure terminal
. The
command prompt is
sensor(config)#
.
•
service mode configuration—Entered from global configuration mode by entering
service
service-name. The command prompt is
sensor(config-ser)#
, where
ser
is the first three
characters of the service name.
•
multi-instance service mode—Entered from global configuration mode by ente ring
service
service-name log-instance-name. The command prompt is
sensor(config-log)#
where
log
is the
first three characters of the log instance name. The only multi-instance services in the system are
anomaly detection, signature definition, and event action rules.
Regular Expression Syntax
Note
The syntax in this section applies only to regular expressions used as part of a CLI comm and. It does not
apply to regular expressions used by signatures.
Regular expressions are text patterns tha t are used for string matching. Regular expressions contain a
mix of plain text and special characters to indicate what kind of matching to do. For example, if you are
looking for a numeric digit, the regular expression to search for is “[0-9]”. The brackets indicate that the
character being compared should match any one of the characters enclosed within the bracket. The dash
(-) between 0 and 9 indicates that it is a range from 0 to 9. Therefore, this regular expression will match
any character from 0 to 9, that is, any digit.
To search for a specific special character, you must use a backslash before the special character. For
example, the single character regular expression “\*” matches a single asterisk.
The regular expressions defined in this section are similar to a subset of the POSIX Extended Regular
Expression definitions. In particular, “[..]”, “[==]”, and “[::]” expressions are n ot supported. Also,
escaped expressions representing single ch aracters are supported. A character can be represen ted as its
hexadecimal value, for example, \x61 equals ‘a,’ so \x61 is an escaped expression representing the
character ‘a.’
The regular expressions are case sensitive. To match “STRING” or “string” use the following regular
expression: “[Ss][Tt][Rr][Ii][Nn][Gg].”
Tabl e 1-2 lists the special characters.
Table1-2 Regular Expression Syntax
Character Description
^ Beginning of the string. The expression “^A” will match an “A” only at the beginning
of the string.
^ Immediately following the left-bracket ([). Excludes the remaining characters within
brackets from matching the target string. The expression “[^0-9]” indicates that the
target character should not be a digit.