Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Disable a Signature in IDSM

Hello all,

How do I disable or filter a signature (1101) in IDSM or IDS MC to stop it from alarming? The number of events generated are overwhelming!

Fact: I'm using VMS to manage and monitor events from IDSM. Has latest sig update (3.05-S39). Thanks

Damien Dinh

New Member

Re: Disable a Signature in IDSM

To disable the signature 1101 at IDS-MC, edit the Enabled field for the signature from Configuration->Settings->Signatures->General after selecting the sensor from the Object Selector Panel.

To exclude this signature, add an exclusive filter at Configuration->Settings->Filters specifying the signature(1101), the source address, and the destination address.

You can find the example of how filter works at the Help page.

After making the above changes, the configuration has to be generated and deployed to the sensor for the changes to take effect. Generate and Deploy can be found in the deployment area.

New Member

Re: Disable a Signature in IDSM

In IDS-MC, I don't have "signatures" and "filters" under: "Configuration->Settings"

I only have:

Port Mapping

Internal Network

Link Status





Is there an additional plugin I need to install?

Thanks for your quick posting, BTW.

New Member

Re: Disable a Signature in IDSM

You need not install any additional plugin. Java Plugin will be loaded when you launch CiscoWorks2000.

Please follow the steps below to configure Signatures and Filters for the device.

1.) Select Configuration->Settings.

2.) Pull out the Object Selector Panel that appears on the Left Hand Side of the screen, where you can see the list of devices added to IDS-MC.

3.) Select the device that you want to configure, from the Object Selector Panel.

4.) Now Signatures and Filters will be shown in the TOC and you should be able to configure it.

CreatePlease login to create content