A-8
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
AppendixA System Architecture
MainApp
Tabl e A-1 shows some examples:
The size of the Event Store allows sufficient buffering of the IPS events when the sensor is not connected
to an IPS event consumer. Sufficient buffering depends on your requirements and the capabilities of the
nodes in use. The oldest events in the circular buffer are replaced by the newest events.
Event Data Structures
The various functional units communicate the following seven types of data:
•
Intrusion events—Produced by the SensorApp. The sensor detects intrusion events.
•
Error events—Caused by hardware or software malfunctions.
•
Status events—Reports of a change in the status of the application, for example, that its
configuration has been updated.
•
Control transaction log events—The sensor logs the result of a control transaction.
•
Attack response events—Actions for the ARC, for example, a block request.
•
Debug events—Highly detailed reports of a change in the status of the application used for
debugging.
•
Control transaction data—Data associated with control transactions, for example, diagnostic data
from an application, session logs, and configuration data to or from an application.
All seven types of data are referred to collectively as IPS data. The six event types—intrusion, error,
status, control transaction log, network access, and debug—have similar characteristics and are referred
to collectively as IPS events. IPS events are produced by the several different applications that make up
the IPS and are subscribed to by other IPS applications. IPS events have the following characteristics:
•
They are spontaneously generated by the application instances configured to do so. There is no
request from another application instance to generate a particular event.
•
They have no specific destination. They are stored and then retrieved by one or more application
instances.
TableA-1 IPS Event Examples
IPS Event
Type
Intrusion
Event Priority
Start Time
Stamp Value
Stop Time
Stamp Value Meaning
status — 0 Maximum value Get all status events that are
stored.
error
status
— 0 65743 Get all error and status events that
were stored before time 65743.
status — 65743 Maximum value Get status events that were stored
at or after time 65743.
intrusion
attack response
low 0 Maximum value Get all intrusion and attack
response events with low priority
that are stored.
attack response
error
status
intrusion
medium
high
4123000000 4123987256 Get attack response, error, status,
and intrusion events with medium
or high priority that were stored
between time 4123000000 and
4123987256.