MinHits and AlarmInterval in IOS IPS signatures

Unanswered Question
Apr 29th, 2007
User Badges:

I'm getting some alarms for signatures that I think are a bit too sensitive -- 3051, for example. It makes sense to me to adjust the Minhits or AlarmInterval to make the signature less sensitive, increasing the level of activity before an alarm occcurs.

However, in every signature I've seen, the AlarmInterval is blank. Is it not used? How can I adjust it if I don't know what it is now? Should I adjust something else? I'm soooo confused!


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
ivillegas Fri, 05/04/2007 - 06:13
User Badges:
  • Silver, 250 points or more

You can configure custom signatures for IOS IPS using Security Monitor which is part of VMS. Below is a doc on how to do this:


Also try this link for Cisco Security Advisory


kwallewein Fri, 05/04/2007 - 06:41
User Badges:

The only VMS I know about is an operating system from DEC. Used it for years. Presume it's not the same.

If VMS is management software for IPS, all I have is SDM. All the management software I know of from Cisco costs much more than the router itself.



This Discussion