Configuring Event Action Overrides - Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual

Event Action Overrides
example, if you want any event with an RR of 85 or more to generate an SNMP trap, you can set the RR
range for Request SNMP Trap to 85-100. If you do not want to use action overrides, you can disable the
entire event action override component.

Configuring Event Action Overrides

Use the overrides [request-block-connection | request-block-host | deny-attacker-inline |
deny-packet-inline | deny-connection-inline | log-attacker-packets | log-victim-packets |
log-pair-packets | reset-tcp-connection | produce-alert | produce-verbose-alert |
request-snmp-trap] command in service event action rules submode to configure the parameters of
event action overrides.
To add event action overrides, follow these steps:
Log in to the CLI using an account with administrator privileges.
Step 1
Enter event action rules submode:
Step 2
sensor# configure terminal
sensor(config)# service event-action-rules rules0
To configure how packets are treated for overrides:
Step 3
Note
a.
b.
c.
d.
To configure overrides to request blocks:
Step 4
a.
b.
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
6-8
The default RR range is 0 to 100. Set it to a different value, such as 85 to 100.
To deny packets from the source IP address of the attacker:
sensor(config-rul)# overrides deny-attacker-inline
To not transmit the single packet causing the alert:
sensor(config-rul-ove)# exit
sensor(config-rul)# overrides deny-packet-inline
To not transmit packets on the specified TCP connection:
sensor(config-rul-ove)# exit
sensor(config-rul)# overrides deny-connection-inline
To send TCP RST packets to terminate the connection:
sensor(config-rul-ove)# exit
sensor(config-rul)# overrides reset-tcp-connection
To request a block of the connection:
sensor(config-rul-ove)# exit
sensor(config-rul)# overrides request-block-connection
To request a block of the attacker host:
sensor(config-rul-ove)# exit
sensor(config-rul-ove)# exit
sensor(config-rul)# overrides request-block-host
Chapter 6 Configuring Event Action Rules
78-16527-01