AIP-SSM - Disabling a Signature for a specific host

dwaring · ‎05-31-2007

Hi,

I am using an ASA-5510 with AIP-SSM, running 5.1 E1.

I am getting a lot of false positives from one internal relating to a TCP SYN Sweep.

I would like these not to be logged for this single host, but don't wish to globally disable or retire the signature.

Is this possible and if so, how?

Thanks in advance,

DAVE

jlimbo · ‎05-31-2007

This is configurable through:

Event Action Rules->Event Action Filters

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids13/idmguide/dmevtrul.htm#wp1082564

-jonathan

dwaring · ‎06-01-2007

Jonathan,

This is what I needed.

Thanks,

DAVE

PAUL GILBERT ARIAS · ‎06-06-2007

Dave, if you want to avoid the false positives for a signature you can create an event action filter and there you can specify the desired host and you can tell which action to filter, in this case you can filter the produce alert. Please check this link:

http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_guide_chapter09186a00804cf4c1.html#wp1063299

I hope it helps