Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

IPs system events and restart

Hi,

I am looking at monitoring the IDS system events like adding users/sensor application restart,interface down with a SDEE client.Does system events like this get logged in detail to the event store to be picked up by the API ...or is there something i need to do with my CIPS ver 6 to get it across with verbose messages .

Thanks and appreciate

1 REPLY
Bronze

Re: IPs system events and restart

Simply go into your IPS and create an "Event Action Filter." Simply modify the source address with that of your scanning system. You can leave the rest pretty much stock or, adjust the destination to the subnet of your DMZ. Also, you'll want to keep an eye on the areas to subtract. Making sure to take away the deny actions, and if necessary, reporting as well.

http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/ime/ime_event_monitoring.html

136
Views
0
Helpful
1
Replies