configure email for IDS event

[mylove142]

I want to configure 3 emails in IDS events . When IDS has a high alert, it will send email to admin. How can I configure?

I use IDSM-2 in Catalyst 6513.

Duy Khang

[john.stark]

You have to use another product to create those email alerts.

The best product to use is Cisco MARS.

Each copy of IDSM was shipped with a copy of Cisco VMS 2.3 product. VPN/Security Managment solution is capable of sending email alerts based on rules.

[mylove142]

Thank you for your answer. However, you can explain more clearly.

I use Catalyst 6513 (Cisco IOS 12.2) + IDSM-2 + FWSM. I use VMS to manage IDSM.

Please show me which steps I must do to create those email alerts.

[mkirbyii]

If you are usng VMS you can setup emails within Security Monitor. This is done using a perl script. See this link for details: http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_example09186a00801fc770.shtml

Also, see this thread:http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Intrusion%20Prevention%20Systems/IDS&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.1dda397b

M

[mylove142]

Thank you for your answer. I have done that but I still can't send email to me.

I use commamd:

blat -install "email server address" "sender email"

But I don't know what is sender email? When I type some emails, then run the command:

emailalert.pl ${Query}, I see the following sentences:

"THE MAIL SERVER DOESN'T LIKE THE SENDER NAME. HAVE YOU SET MAIL ADDRESS CORRECTLY".

You can explain more clearly about sender email and I type correctly.

Thank you very much.

[mylove142]

If you know the problem, please help me?

In VMS,

cd E:\CSCOpx\MDC\etc\ids\scritps

blat -install mailserver-address source-email

I don't know about the source-email, I looked in IDSM configuratioon and I don't see email address.

Please help me. Thank you very much.

Duy Khang