Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Looking for IDS/IPS event list

Could someone point me at a document repository that list all possible events which could be issued by a CISCO IDS NETWORK MODULE FOR CISCO 2800 SERIES ROUTERS (NM-CIDS-K9)

Thanks in advance,

3 REPLIES
New Member

Re: Looking for IDS/IPS event list

The NM-Module runs Sensor OS so the signatures available will depends on what Signature level you have applied. The latest signature version is S211.

All signatures available can be accessed here:

http://tools.cisco.com/MySDN/Intelligence/allSignatures.x

New Member

Re: Looking for IDS/IPS event list

Just to confirm, this would mean that NM-Module would have the same events as a standalone appliance such as Cisco IDS-4215.

Cisco Employee

Re: Looking for IDS/IPS event list

99% of the time yes when both are running the same version and sig level.

The less than 1% exception is because the IDS-4215 is capable of running in both Promiscuous and InLine mode, but the NM-CIDS is currently limited to InLine mode. So there are a small set of signatures on a IDS-4215 that will only fire when run in InLine mode, and so will not be seen on a NM-CIDS.

128
Views
0
Helpful
3
Replies
CreatePlease login to create content