1-10
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter1 In troducing the CLI Configuration Guide
Generic CLI Commands
To create a regular expression that recalls a previous pattern, you use parentheses to indicate memory of
a specific pattern and a backslash (\) followed by a digit to reuse the remembered pattern. The digit
specifies the occurrence of a parentheses in the regular expression pattern. If you have more than o ne
remembered pattern in your regular expression, \1 indicates the first remembered pattern, and \2
indicates the second remembered pattern, and so on.
The following regular expression uses parentheses for recall:
•
a(.)bc(.)\1\2 matches an a followed by any character, followed by bc followed by any character,
followed by the first any character again, followed by the second any character again.
For example, the regular expression can match aZbcTZT. The software remembers that the first
character is Z and the second character is T and then uses Z and T again later in the regular
expression.
Generic CLI Commands
The following CLI commands are generic to the Cisc o IPS.
•
configure terminal—Enters global configuration mode.
Global configuration commands apply to features that affect the system as a whole rather than just
one protocol or interface.
sensor# configure terminal
sensor(config)#
•
service—Takes you to the following configuration submodes: analysis-engine, anomaly-detection,
authentication, event-action-rules, external-product-interfaces, global-correlation, health-monitor,
host, interface, logger, network-access, notification, signature-definition, ssh-known-hosts,
trusted-certificates, and web-server.
Note
The anomaly-detection, event-action-rules, and signature-definition submodes are multiple
instance services. One predefined instance is allowed for each. For anomaly-detection, the
predefined instance name is ad0. For event-action-rules, the predefined instance name is
rules0. For signature-definition, the predefined instance name is sig0. You can create
additional instances.
sensor# configure terminal
sensor(config)# service event-action-rules rules0
sensor(config-rul)#
•
end—Exits configuration mode or any configuration submodes. It takes you back to the top-level
EXEC menu.
sensor# configure terminal
sensor(config)# end
sensor#
•
exit—Exits any configuration mode or closes an active terminal session and terminates the EXEC
mode. It takes you to the previous menu session.
sensor# configure terminal
sensor(config)# service event-action-rules rules0
sensor(config-rul)# exit
sensor(config)# exit
sensor#