Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

specifically tuning sig 3030

I am receiving a number of these alarms all from internal hosts. Specifically how would you tune this signature to reduce the number? Or would you want to see all of these alarms? Or just filter it entirely for internal hosts? I am wondering if it would be similar to sig2100, where I set it to summarize instead of fireall.

Thank You

1 REPLY
Cisco Employee

Re: specifically tuning sig 3030

3030 can be viewed as a normal behaviour if its on the inside of the network. You may just want to filter that host alltogether. Or as you said can tune it to GlobalSummarize.

thanks,

yatin

91
Views
5
Helpful
1
Replies
CreatePlease to create content