IPs system events and restart

Unanswered Question
Apr 25th, 2008
User Badges:


I am looking at monitoring the IDS system events like adding users/sensor application restart,interface down with a SDEE client.Does system events like this get logged in detail to the event store to be picked up by the API ...or is there something i need to do with my CIPS ver 6 to get it across with verbose messages .

Thanks and appreciate

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
htarra Fri, 05/02/2008 - 11:05
User Badges:
  • Bronze, 100 points or more

Simply go into your IPS and create an "Event Action Filter." Simply modify the source address with that of your scanning system. You can leave the rest pretty much stock or, adjust the destination to the subnet of your DMZ. Also, you'll want to keep an eye on the areas to subtract. Making sure to take away the deny actions, and if necessary, reporting as well.



This Discussion