Cisco Systems IPS4510K9 IDAPI, IDIOM

A-32
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
AppendixA System Architecture
Communications
IDAPI
IPS applications use an interprocess communication API called the IDAPI to handle internal
communications. The IDAPI reads and writes event data and provides a mechanism for control
transactions. The IDAPI is the interface through which all the applications communicate.
The SensorApp captures and analyzes the network traffic on its interfaces. When a signature is ma tched,
the SensorApp generates an alert, which is stored in the Event Store. If the signature is configured to
perform the blocking response action, the SensorApp generates a block event, which is also stored in the
Event Store.
Figure A-6 illustrates the IDAPI interface.
Figure A-6 IDAPI
Each application registers to the IDAPI to send and receive events and control transactions. The IDAPI
provides the following services:
• Control transactions
– Initiates the control transaction.
– Waits for the inbound control transaction.
– Responds to the control transaction.
• IPS events
– Subscribes to remote IPS events, which are stored in the Event Store when received.
– Reads IPS events from the Event Store.
– Writes IPS events to the Event Store.
The IDAPI provides the necessary synchronization mechanisms to guarantee atomic data accesses.
IDIOM
IDIOM is a data format standard that defines the event messag es that are reported by the IPS as well as
the operational messages that are used to configure and control intrusion detection systems. These
messages consist of XML documents that conform to the IDIOM XML schema.
IDIOM supports two types of interactions: event and control transaction. Event interactions are used to
exchange IPS events such as alerts. IDIOM uses two types of messages for event interactions: event and
error messages. Control transactions provide a means for one host to initiate an action in, change the
state of, or read the state of another host. Control transactions utilize four types of IDIOM messages:
request, response, configuration, and error messages. Events and control transactions that are
communicated between application instances within a host are known as local events or local control
transactions, or collectively, local IDIOM messages. Events and control transactions that are
communicated between different hosts are known as remote events and remote control transactions, or
collectively, remote IDIOM messages.
Note IDIOM for the most part has been superseded by IDCONF, SDEE, and CIDEE.
119096
Alert
Block
request
Alert
Block
request
IDAPI
SensorApp Event Store