topic Re: Event Action Filter not working in Network Security

Event Action Filter not working

ola — Sun, 10 Mar 2019 11:48:48 GMT

Hi,

We are running an IDSM-2 with 7.0(1)E3 and 2 virtual sensors.

I want to filter alarms from sig 2004 for a monitoring server.

When adding an event action filter, it still sends alarms. Bug?? Is there another way to filter the alarms for a specific host?

Regards

/Ola

Re: Event Action Filter not working

andrey.dugin — Wed, 28 Oct 2009 09:42:37 GMT

Event action rules set is assigned to virtual sensor. If you have assigned event action rules set to one virtual sensor and another rules to another vs:

rules0 - vs0

rules1 - vs1

you must create filter on every rules set to substract some action on whole sensor.

Re: Event Action Filter not working

ola — Wed, 28 Oct 2009 09:52:01 GMT

Hi,

I tried to apply the same filter to both sensors, same result, I still get the alarms.

Re: Event Action Filter not working

andrey.dugin — Wed, 28 Oct 2009 10:08:58 GMT

Sig 2004/0 ICMP Echo Request is disabled by default.

Did you activate the same action in signature action and substract action in the filter?

Re: Event Action Filter not working

ola — Wed, 28 Oct 2009 10:32:17 GMT

I enabled the signature in one sensor and want to filter alarms for one specific ip address.

Re: Event Action Filter not working

andrey.dugin — Wed, 28 Oct 2009 13:34:20 GMT

OK, but, for example, if you activate action "produce verbose alert" in signature but check the action to substract "produce alert" or don't check any filters must not work.

Post the config fragments of signature and of filters here.

Re: Event Action Filter not working

ola — Thu, 29 Oct 2009 07:56:27 GMT

I removed produce alert on the signature.

Enabled it again and then reapplied the filter, and for some reason, it now works. Anyway, thanks for your help.