Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 20: IPS Attack and System Event Responses
Configuring new event types
Configuring new
event types
Ignoring network
probe attempts
578
You may decide that you would like to add a customized IPS attack or system
event type to the pre-defined list. New entries can be created using the
command line. Once added, the new event will appear on the appropriate list in
the Admin Console. At that point, you may create new responses for that
event.
To add a new attack or system event type, do the following:
1 Start a command line session with Sidewinder G2 and log in.
2 Use the srole command to switch to the administrator role.
3 Enter the following command, using a single line:
cf audit add filter name=name filter_type=system|attack
sacap_filter=sacap_filter number=int comments=comments
where:
• name = name of the new event type.
• system|attack = type of filter. This option determines if the new event
type will appear on the IPS Response attack type list or the System
Responses event list.
• sacap_filter = string which identifies a sacap_filter expression to use
• int = number of SNMP trap to use. See “Sidewinder G2 SNMP traps”
on page 579 for more information about SNMP traps.
• comments = text that will appear in the Event tab’s Description field.
Refer to the cf_audit and the sacap_filter man pages for information for
configuring event types (referred to as filters) and responses (referred to as
auditbots). Refer to acat -c for a list of current audit events.
If a host on the network attempts to connect to the Sidewinder G2 for a service
that is not running, an audit record is generated and may trigger an alarm. An
ignore list can be set up to ignore unimportant network probe audit events, but
save the audit to keep track of the probe attempts. However, if connection
attempts are frequent and are coming from a trusted network, then it may be
desirable to ignore them completely and not audit the connection attempt by
configuring the appropriate IP Filter rules.