IPS SNMP alarms

jacques_henry696 · ‎01-22-2010

Hi,

My question concerns the way to send SNMP traps as an alert format.

I am totally aware that the AIP-SSM/IPS 4200 does not support syslog as an alert format.

The default method is through SDEE but I really don't want to use MARS to get my security events (I have more than 10 devices so don't think about IME )

I'e read that I have to configure individual signatures in order to generate a SNMP trap as an action to take when they are triggered.

So is this correct?:

Is it possible to enable it "globally"? For example for all signatures with a level higher than informational? Is it done with this option? :

what is the first action "deny packet inline"? Is it really done because I am using the AIP-SSM in promiscuous mode...

Thanks a lot!

jan.odzgan · ‎01-24-2010

Hello

I also miss syslog in Cisco IPS. But your problem is solvable. You can use Event Action Overrides for set added action (SNMP trap) to all alarm which reach specific risk (maybe high risk, or medium risk, or low risk, or user defined risk as you need). Value "Informational" is not risk value, it is severity (only one part of risk value).

Deny packet inline is usable only in inline mode. This action drop packet which is triggered by specific signature. You can use only TCP reset action to stop some kind of attack in promiscious mode.

jacques_henry696 · ‎01-27-2010

Hello,

You can use Event Action Overrides for set added action (SNMP trap) to all alarm which reach specific risk (maybe high risk, or medium risk, or low risk, or user defined risk as you need).

When you're talking about the "Event Action Overrides", are you referring to the second screenshot I've posted? In this configuration, all enabled signatures should trigger a SNMP trap, right? (even if I didn't set the "request SNMP trap" option in all signatures?)

Deny packet inline is usable only in inline mode. This action drop packet which is triggered by specific signature. You can use only TCP reset action to stop some kind of attack in promiscious mode.

Yes that's what I thought. But this action (Deny packet inline) is not removable from the HIGHRISK. So it is not taken into account when using the IPS in promicuous mode?

Thanks,

Regards.