topic Re: AIP-SSM-20 to send Syslog messages in Network Security

AIP-SSM-20 to send Syslog messages

claude.fozao — Sun, 10 Mar 2019 12:16:39 GMT

Dear all,

I want to find out if there is any means of configuring my AIP-SSM-20 to generate and send a syslog message whenever it blocks a connection, drops a packet or find any anomaly traffic traversing through it from either the Internet or the Internal network. For audit reasons, my management wants to see this logs send to a syslog server. I have been trying to use IME( IPS Manager Express) to configure this but have not seen any option relating to Syslogs.

Please if there is a means, let me know and also give me instructions on how to do it.

I would be greatful for your assistance.

Kind Regards

Claude Fozao

Re: AIP-SSM-20 to send Syslog messages

Jennifer Halim — Thu, 24 Feb 2011 06:58:32 GMT

No, unfortunately the Cisco IPS events are in Cisco proprietary format, hence there is no option to actually send those events through syslog messages.

Re: AIP-SSM-20 to send Syslog messages

claude.fozao — Thu, 24 Feb 2011 07:30:24 GMT

Jennifer,

Thanks for your prompt response. In this case, is there a way to retrive all the past events from the event store. I believe that this events are saved in an event store which can be retrived and analysed.

Thanks again

Re: AIP-SSM-20 to send Syslog messages

Siddharth Chandrachud — Thu, 24 Feb 2011 07:46:21 GMT

Syslog is UDP based. A packet if lost cannot be re-transmitted.

For event retrieval, not convenient. Does not achieve guaranteed data transfer.

Not the best option if all data has to be recorded for audit purposes.

Hence for IPS the event retrieval is done via SDEE protocol which is TCP based.

SDEE is not Cisco Proprietary.

Please check:

https://supportforums.cisco.com/docs/DOC-12515

The IPS events are stored in its own event store.

The capacity of this event store is limited and old events can get overwritten.

Hence IPS requires a device to retrieve events from its event store if you wish to store all the events.

IME can retrieve events from the IPS event store and store it locally.

IME installs a my-sql database on the machine.

You can store upto 400 archive files each containing max 1 million events.

Hope this helps.

Sid Chandrachud

TAC Security Solutions

Re: AIP-SSM-20 to send Syslog messages

Pavel Pokorny — Fri, 25 Feb 2011 13:45:08 GMT

Hi,

You can find it in syslog from ASA.

It will look like this : %ASA-4-420003: IPS requested to reset TCP connection from

I suppose, this is enough.

But from IPS module - as TACman said...

HTH

Pavel

Re: AIP-SSM-20 to send Syslog messages

claude.fozao — Sat, 26 Feb 2011 12:39:33 GMT

Hi Pavel,

That worked for me. I decided to log message IDs 420002 and 420003.

Thanks

Re: AIP-SSM-20 to send Syslog messages

Pavel Pokorny — Sat, 26 Feb 2011 18:17:39 GMT

Hi Claude,

Good to hear advice helped.

Please sign if problem solved for you.

Pavel

AIP-SSM-20 to send Syslog messages

ryanhoibm — Wed, 11 Jan 2012 14:11:53 GMT

Hi Sid Chandrachud,

Hence IPS requires a device to retrieve events from its event store if you wish to store all the events.

May I know what device is needed to archive all the events?

Can it be a normal linux or windows server to store the SDEE events? if possbile how to configure the IPS to send events to external servers?

Regards

Ryan