Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

Customizing sensor from filtering false alarms.

hi,

How can i filter the false alarms coming out from my dhcp server and dns servers. Iam getting a lot of frag overlap signature alarms.Can anyone help me to avoid these false alarms ? Please help.

1 REPLY
Cisco Employee

Re: Customizing sensor from filtering false alarms.

Hi,

You cna configure event action filter for those host you do not want the sensor to do any further action for the specific signatures.

This is described here : http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids12/idmguide/dmevtrul.htm#wp1063299

I hope this helps you.

124
Views
0
Helpful
1
Replies
CreatePlease to create content