new connection signatures

[teperjesi]

Hi,

I've made some new connections signatures. They work properly, but i wan to filter these alarms (source IP), but when I select the Connections Signature on the filter tab the "new signature" button is inactive! I've made some entries in the Epiloge field to filter these alarms.

My question is: May I use the "new Signature" button to filter my own connection signatures?

Thanks

[mchin345]

It's pretty easy to prevent certain source from setting off alarms. Click the Sensor icon. Then click the Simple Filtering tab followed by 'Add' to define new settings. Now you can specify the signature, subsignature, IP , Mask etc. Finish by clicking OK and saving the changes. Please refer to http://www.cisco.com/univercd/cc/td/doc/product/ismg/policy/ver23i/idsguide/ch07.htm#157372 for the exact procedure.