A-9
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Appendix A System Architecture
MainApp
Control transactions involve the following types of requests:
•
Request to update the configuration data of an application instance
•
Request for the diagnostic data of an application instance
•
Request to reset the diagnostic data of an application instance
��
Request to restart an application instance
•
Request for ARC, such as a block request
Control transactions have the following characteristics:
•
They always consist of a request followed by a response.
The request and response may have an arbitrary amount of data associated with them. The response
always includes at least a positive or negative acknowledgment.
•
They are point-to-point transactions.
Control transactions are sent by one application instance (the initiator) to another application
instance (the responder).
IPS data is represented in XML format as an XML document. The system stores user-configurable
parameters in several XML files.

IPS Events

IPS applications generate IPS events to report the occurrence of some stimulus. The events are the data,
such as the alerts generated by SensorApp or errors generated by any application. Events are stored in a
local database known as the Event Store.
There are five types of events:
•
evAlert—Alert event messages that report when a signature is triggered by network activity.
•
evStatus—Status event messages that report the status and actions of the IPS applications.
•
evError— Error event messages that report errors that occurred while attempting response actions.
•
evLogTransaction—Log transaction messages that report the control transactions processed by each
sensor application.
•
evShunRqst—Block request messages that report when ARC issues a block request.
You can view the status and error messages using the CLI, IME, and ASDM. The SensorApp and ARC
log response actions (TCP resets, IP logging start and stop, blocking start and stop, trigger packet) as
status messages.
NotificationApp
The NotificationApp allows the sensor to send alerts and system error messages as SNMP traps. It
subscribes to events in the Event Store and translates them into SNMP MIBs and sends them to
destinations through a public-domain SNMP agent. The NotificationApp supports sending sets and gets.
The SNMP GETs provide information about basic sensor health.
The NotificationApp sends the following information from the evAlert event in sparse mode:
•
Originator information
•
Event ID
•
Event severity