topic filter events for specific device in Network Security https://community.cisco.com/t5/network-security/filter-events-for-specific-device/m-p/1778364#M56342 <P>We have a SSM module in each of our ASA-5520's and they have never really been configured correctly.&nbsp; Ive taken this on and am trying to learn IDS/IPS as I go.&nbsp; The first problem that I am seeing is that its reporting our NMS system as a possible threat because of the continual network PING sweeps that it does to monitor the network.&nbsp; The ID its reporting is 2100/0 - ICMP Network Sweep w/Echo.&nbsp; Anyway, my question is how do tell it to continue to monitor this signature, but filter out the specific address for our NMS?&nbsp; Thanks</P> Sun, 10 Mar 2019 12:27:47 GMT lukeprimm 2019-03-10T12:27:47Z filter events for specific device https://community.cisco.com/t5/network-security/filter-events-for-specific-device/m-p/1778364#M56342 <P>We have a SSM module in each of our ASA-5520's and they have never really been configured correctly.&nbsp; Ive taken this on and am trying to learn IDS/IPS as I go.&nbsp; The first problem that I am seeing is that its reporting our NMS system as a possible threat because of the continual network PING sweeps that it does to monitor the network.&nbsp; The ID its reporting is 2100/0 - ICMP Network Sweep w/Echo.&nbsp; Anyway, my question is how do tell it to continue to monitor this signature, but filter out the specific address for our NMS?&nbsp; Thanks</P> Sun, 10 Mar 2019 12:27:47 GMT https://community.cisco.com/t5/network-security/filter-events-for-specific-device/m-p/1778364#M56342 lukeprimm 2019-03-10T12:27:47Z filter events for specific device https://community.cisco.com/t5/network-security/filter-events-for-specific-device/m-p/1778365#M56344 <HTML><HEAD></HEAD><BODY><P>Luke -</P><P></P><P>You are looking for an "event action filter".</P><P><A class="jive-link-external-small" href="http://www.cisco.com/en/US/docs/security/ips/7.1/configuration/guide/idm/idm_event_action_rules.html#wp2136561">http://www.cisco.com/en/US/docs/security/ips/7.1/configuration/guide/idm/idm_event_action_rules.html#wp2136561</A></P><P></P><P>- Bob</P></BODY></HTML> Tue, 30 Aug 2011 20:30:57 GMT https://community.cisco.com/t5/network-security/filter-events-for-specific-device/m-p/1778365#M56344 rhermes 2011-08-30T20:30:57Z