IPs system events and restart

Unanswered Question
Apr 25th, 2008

Hi,

I am looking at monitoring the IDS system events like adding users/sensor application restart,interface down with a SDEE client.Does system events like this get logged in detail to the event store to be picked up by the API ...or is there something i need to do with my CIPS ver 6 to get it across with verbose messages .

Thanks and appreciate

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
htarra Fri, 05/02/2008 - 11:05

Simply go into your IPS and create an "Event Action Filter." Simply modify the source address with that of your scanning system. You can leave the rest pretty much stock or, adjust the destination to the subnet of your DMZ. Also, you'll want to keep an eye on the areas to subtract. Making sure to take away the deny actions, and if necessary, reporting as well.

http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/ime/ime_event_monitoring.html

Actions

This Discussion