IPs system events and restart

maheshbalasub75 · ‎04-25-2008

Hi,

I am looking at monitoring the IDS system events like adding users/sensor application restart,interface down with a SDEE client.Does system events like this get logged in detail to the event store to be picked up by the API ...or is there something i need to do with my CIPS ver 6 to get it across with verbose messages .

Thanks and appreciate

htarra · ‎05-02-2008

Simply go into your IPS and create an "Event Action Filter." Simply modify the source address with that of your scanning system. You can leave the rest pretty much stock or, adjust the destination to the subnet of your DMZ. Also, you'll want to keep an eye on the areas to subtract. Making sure to take away the deny actions, and if necessary, reporting as well.

http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/ime/ime_event_monitoring.html