Cisco Systems IPS4510K9 Event Data Structures, Table A-1shows some examples, Stamp Value Meaning

Appendix A System Architecture

MainApp

Table A-1shows some examples:

Table A-1	IPS Event Examples
IPS Event		Intrusion	Start Time	Stop Time
Type		Event Priority	Stamp Value	Stamp Value	Meaning
status		—	0	Maximum value	Get all status events that are
					stored.
error		—	0	65743	Get all error and status events that
status					were stored before time 65743.
status		—	65743	Maximum value	Get status events that were stored
					at or after time 65743.
intrusion		low	0	Maximum value	Get all intrusion and attack
attack response					response events with low priority
					that are stored.
attack response		medium	4123000000	4123987256	Get attack response, error, status,
error		high			and intrusion events with medium
status					or high priority that were stored
intrusion					between time 4123000000 and
					4123987256.

The size of the Event Store allows sufficient buffering of the IPS events when the sensor is not connected to an IPS event consumer. Sufficient buffering depends on your requirements and the capabilities of the nodes in use. The oldest events in the circular buffer are replaced by the newest events.

Event Data Structures

The various functional units communicate the following seven types of data:

•Intrusion events—Produced by the SensorApp. The sensor detects intrusion events.

•Error events—Caused by hardware or software malfunctions.

•Status events—Reports of a change in the status of the application, for example, that its configuration has been updated.

•Control transaction log events—The sensor logs the result of a control transaction.

•Attack response events—Actions for the ARC, for example, a block request.

•Debug events—Highly detailed reports of a change in the status of the application used for debugging.

•Control transaction data—Data associated with control transactions, for example, diagnostic data from an application, session logs, and configuration data to or from an application.

All seven types of data are referred to collectively as IPS data. The six event types—intrusion, error, status, control transaction log, network access, and debug—have similar characteristics and are referred to collectively as IPS events. IPS events are produced by the several different applications that make up the IPS and are subscribed to by other IPS applications. IPS events have the following characteristics:

•They are spontaneously generated by the application instances configured to do so. There is no request from another application instance to generate a particular event.

•They have no specific destination. They are stored and then retrieved by one or more application instances.

Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2

A-8 OL-29168-01