cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
323
Views
0
Helpful
2
Replies

MinHits and AlarmInterval in IOS IPS signatures

kwallewein
Level 1
Level 1

I'm getting some alarms for signatures that I think are a bit too sensitive -- 3051, for example. It makes sense to me to adjust the Minhits or AlarmInterval to make the signature less sensitive, increasing the level of activity before an alarm occcurs.

However, in every signature I've seen, the AlarmInterval is blank. Is it not used? How can I adjust it if I don't know what it is now? Should I adjust something else? I'm soooo confused!

/kenw

2 Replies 2

ivillegas
Level 6
Level 6

You can configure custom signatures for IOS IPS using Security Monitor which is part of VMS. Below is a doc on how to do this:

http://www.cisco.com/en/US/products/sw/cscowork/ps3990/products_user_guide_chapter09186a0080104f44.html#xtocid9

Also try this link for Cisco Security Advisory

http://www.cisco.com/en/US/products/products_security_advisory09186a008055dbdd.shtml

The only VMS I know about is an operating system from DEC. Used it for years. Presume it's not the same.

If VMS is management software for IPS, all I have is SDM. All the management software I know of from Cisco costs much more than the router itself.

/kenw

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: