B-8
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
AppendixB Signature Engines
Master Engine
Event Actions
The Cisco IPS supports the following event actions. Most of the event actions belong to each signature
engine unless they are not appropriate for that particular engine.
Alert and Log Actions
•
produce-alert—Writes an evIdsAlert to Event Store.
•
produce-verbose-alert—Includes an encoded dump (possibly tru ncated) of the offending packet in
the evIdsAlert.
•
log-attacker-packets—Starts IP logging of packets containing the attacker address and sends an
alert.
•
log-victim-packets—Starts IP logging of packets containing the victim address a nd sends an alert.
•
log-pair-packets (inline mode only)—Starts IP logging of packets containing the attacker/victim
address pair.
•
request-snmp-trap—Sends request to the NotificationApp to perform SNMP notification.
Deny Actions
•
deny-packet-inline (inline mode only)—Does not transmit this packet.
Note
You cannot delete the event action override for deny-packet-inline because it is protected. If
you do not want to use that override, set the override-item-status to disabled for that entry.
•
deny-connection-inline (inline mode only)—Does not transmit this packet and future packets on the
TCP Flow.
•
deny-attacker-victim-pair-inline (inline mode only)—Does not transmit this packet and future
packets on the attacker/victim address pair for a specified period of time.
•
deny-attacker-service-pair-inline (inline mode only)—Does not transmit this packet and future
packets on the attacker address victim port pair for a specified period of time.
specify-global-summary-thres
hold {yes |no}
Enables global summary threshold mode:
•
global-summary-threshold—Specifies the
threshold number of events to take alerts
into global summary.
1 to 65535
summary-key Specifies the storage type on which to
summarize this signature:
•
Attacker address
•
Attacker and victim addresses
•
Attacker address and victim port
•
Victim address
•
Attacker and victim addresses and ports
Axxx
AxBx
Axxb
xxBx
AaBb
TableB-2 Master Engine Alert Frequency Parameters (continued)
Parameter Description Value