Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual page 110

Event Action Filters
Set the victim port range:
e.
sensor(config-rul-fil)# victim-port-range 0-434
The default is 0 to 65535.
Set the risk rating range:
f.
sensor(config-rul-fil)# risk-rating-range 85-100
The default is 0 to 100.
Set the actions to remove:
g.
sensor(config-rul-fil)# actions-to-remove reset-tcp-connection
You can choose from the following actions:
request-block-connection
request-block-host
deny-attacker-inline
deny-packet-inline
deny-connection-inline
log-attacker-packets
log-victim-packets
log-pair-packets
reset-tcp-connection
produce-alert
produce-verbose-alert
request-snmp-trap
Set the status of the filter to either disabled or enabled.
h.
sensor(config-rul-fil)# filter-item-status [enable | disable]
The default is enabled
Set the stop on match parameter.
i.
sensor(config-rul-fil)# stop-on-match [true | false]
True tells the sensor to stop processing filters if this item matches. False tells the sensor to continue
processing filters even if this item matches.
Add any comments you want to explain this filter:
j.
sensor(config-rul-fil)# user-comments
Verify the settings for the filter:
Step 5
sensor(config-rul-fil)# show settings
NAME: name1
-----------------------------------------------
-----------------------------------------------
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
6-12
signature-id-range: 1000-10005 default: 900-65535
subsignature-id-range: 1-5 default: 0-255
attacker-address-range: 10.89.10.10-10.89.10.23 default: 0.0.0.0-255.255.255.255
victim-address-range: 192.56.10.1-192.56.10.255 default: 0.0.0.0-255.255.255.255
attacker-port-range: 0-65535 <defaulted>
victim-port-range: 1-343 default: 0-65535
risk-rating-range: 85-100 default: 0-100
actions-to-remove: reset-tcp-connection default:
filter-item-status: Enabled default: Enabled
stop-on-match: True default: False
user-comment: This is a new filter. default:
Request SHUN of connection
Request SHUN of attacker host
Do not transmit packets with source address of
attacker
Do not transmit the single packet causing alert
Do not transmit packets on this TCP connection
Activate packet logging for attacker address
Activate packet logging for victim address
Activate packet logging for attacker/victim address pair
Send TCP RST packets to terminate connection
Write evIdsAlert to EventStore
Write evIdsAlert to EventStore with triggerPacket
Write evIdsAlert to EventStore with SNMP request in
AlarmTraits
Chapter 6 Configuring Event Action Rules
78-16527-01