VMS secmon and Trigger Packet

Unanswered Question
May 25th, 2007
User Badges:

Right, in the network is a VMS Server 2.3sp2 and several 5.1.5E1s283.0 sensors. We have enabled the following commands on the sensors:

overrides produce-verbose-alert

override-item-status Enabled

risk-rating-range 50

SDEE events are received in VMS SecMon console. In the past with this enabled, when the Risk Rating was above 50 on any event received in the console, this would produce a (verbose) trigger packet that would be viewable on the console by right clicking the event and the selecting tools/trigger packet. However it seams that this is not the case anymore.

Could someone tell me if this function still works or has something changed that makes it not possible anymore?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 3.5 (2 ratings)
rhermes Fri, 05/25/2007 - 08:44
User Badges:
  • Gold, 750 points or more

Check to see if you are still reporting Risk Ratings on your events in SecMon. We have had some senor updates break Risk Ratings. Re-importing the sensor in VMS fixes that problem.

darin.marais Wed, 05/30/2007 - 00:35
User Badges:

If I run show event on a sensor were I have enabled the commands:

overrides produce-verbose-alert

override-item-status Enabled

risk-rating-range 50

The event that is captured on the screen is as follows.

sensor# sh events

evIdsAlert: eventId=removed severity=high vendor=Cisco


hosted sensor

appName: sensorApp

appInstanceId: 5037

time: 2007/05/30 08:05:57 2007/05/30 10:05:57 CET

signature: description=Cursor/Icon File Format Buffer Overflow id=5442 version=S137

subsigId: 0

sigDetails: Malicious ANI File


vlan: 0



addr: locality=OUT removed

port: 8080


addr: locality=OUT removed

port: 46531



text removed


text removed

riskRatingValue: 60

interface: ge2_0

protocol: tcp

The event includes the risk rating value. Is that what you mean?

In the past the events collected were IDIOM events but now the are SDEE. Is there a difference as far as the triggered packets are concerned. In the past the event included a section called triggerPacket but I don?t see that anymore.


This Discussion