Cisco Systems IPS4510K9 manual Alert Frequency, Obsoletes, Vulnerable OS List

Appendix B Signature Engines

Master Engine

Obsoletes

The Cisco signature team uses the obsoletes field to indicate obsoleted, older signatures that have been replaced by newer, better signatures, and to indicate disabled signatures in an engine when a better instance of that engine is available. For example, some String XL hardware-accelerated signatures now replace equivalent signatures that were defined in the String engine.

Vulnerable OS List

When you combine the vulnerable OS setting of a signature with passive OS fingerprinting, the IPS can determine if it is likely that a given attack is relevant to the target system. If the attack is found to be relevant, the risk rating value of the resulting alert receives a boost. If the relevancy is unknown, usually because there is no entry in the passive OS fingerprinting list, then no change is made to the risk rating. If there is a passive OS fingerprinting entry and it does not match the vulnerable OS setting of a signature, the risk rating value is decreased. The default value by which to increase or decrease the risk rating is +/- 10 points.

For More Information

•For more information about promiscuous mode, see Understanding Promiscuous Mode, page 4-14.

•For more information about passive OS fingerprinting, see Configuring OS Identifications, page 8-26.

Alert Frequency

The purpose of the alert frequency parameter is to reduce the volume of the alerts written to the Event Store to counter IDS DoS tools, such as stick. There are four modes: fire-all, fire-once, summarize, and global-summarize. The summary mode is changed dynamically to adapt to the current alert volume. For example, you can configure the signature to fire-all, but after a certain threshold is reached, it starts summarizing.

Table B-2lists the alert frequency parameters.

Table B-2	Master Engine Alert Frequency Parameters
Parameter		Description		Value
summary-mode		Specifies the mode used for summarization:		fire-all
		• fire-all—Fires an alert on all events.		fire-once
		• fire-once—Fires an alert only once.		global-summarize
		• global-summarize—Summarizes an alert so		summarize
			that it only fires once regardless of how
			many attackers or victims.
		•	summarize—Summarizes alerts.
specify-summary-threshold		Enables summary threshold mode:		0 to 65535
{yes no}		•	summary-threshold—Specifies the	1 to 1000
			threshold number of alerts to send a
			signature into summary mode.
		• summary-interval—Specifies the time in
			seconds used in each summary alert.

Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2

OL-29168-01 B-7