A-34
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
AppendixA System Architecture
Cisco IPS File Structure

CIDEE

CIDEE specifies the extensions to SDEE that are used by the Cisco IPS. The CIDEE standard specifies
all possible extensions that are supported by the Cisco IPS. Specific systems may implement a subset of
CIDEE extensions. However, any extension that is designated as being required MUST be supported by
all systems. CIDEE specifies the Cisco IPS-specific security device events and the IPS extensions to the
SDEE evIdsAlert element.
CIDEE supports the following events:
•
evError—Error event
Generated by the CIDEE provider when the provider detects an error or warning condition. The
evError event contains error code and textual description of the error.
•
evStatus—Status message event
Generated by CIDEE providers to indicate that something of potential interest occurred on the host.
Different types of status messages can be reported in the status event—one message per event. Each
type of status message contains a set of data elements that are specific to the type of occurrence that
the status message is describing. The information in many of the status messages are useful for audit
purposes. Errors and warnings are not considered status information and are re ported using evError
rather than evStatus.
•
evShunRqst—Block request event
Generated to indicate that a block action is to be initiated by the service that handles network
blocking.
The following is a CDIEE extended event example:
<sd:events xmlns:cid="http://www.cisco.com/cids/2004/04/cidee"
xmlns:sd=“http://example.org/2003/08/sdee”>
<sd:evIdsAlert eventId="1042648730045587005" vendor="Cisco“ severity="medium">
<sd:originator>
<sd:hostId>Beta4Sensor1</sd:hostId>
<cid:appName>sensorApp</cid:appName>
<cid:appInstanceId>8971</cid:appInstanceId>
</sd:originator>
<sd:time offset="0" timeZone="UTC">1043238671706378000</sd:time>
<sd:signature description="IOS Udp Bomb" id="4600" cid:version="S37">
<cid:subsigId>0</cid:subsigId>
</sd:signature> …
Cisco IPS File Structure
The Cisco IPS has the following directory structure:
•
/usr/cids/idsRoot—Main installation directory.
•
/usr/cids/idsRoot/shared—Stores files used during system recovery.
•
/usr/cids/idsRoot/var—Stores files created dynamically while the sensor is running.
•
/usr/cids/idsRoot/var/updates—Stores files and logs for update installations.
•
/usr/cids/idsRoot/var/virtualSensor—Stores files used by SensorApp to analyze regular expressions.
•
/usr/cids/idsRoot/var/eventStore—Contains the Event Store application.
•
/usr/cids/idsRoot/var/core—Stores core files that are created during syst em crashes.
•
/usr/cids/idsRoot/var/iplogs—Stores IP log file data.