topic Re: Filtering only high alerts in Network Security

Filtering only high alerts

5creedus — Sun, 10 Mar 2019 11:08:58 GMT

I have a range of IP's that I never want to see any high priority alerts, but need to see any other alerts. How would I do that?

thanks

Re: Filtering only high alerts

Farrukh Haroon — Wed, 11 Jun 2008 20:16:28 GMT

The best way to control this would be to filter those hosts based on the Risk Rating, using 'Event Action Filters' you can subtract actions from alerts. So for these hosts you could subtract the 'Product Alert' action based on a specific Risk Rating value.

Have a look at:

http://www.cisco.com/en/US/docs/security/ips/6.0/configuration/guide/idm/dmEvtRul.html#wp1034361

Regards

Farrukh

Re: Filtering only high alerts

5creedus — Wed, 11 Jun 2008 22:41:07 GMT

thanks, more detailed information on the risk ratings?

Re: Filtering only high alerts

Farrukh Haroon — Thu, 12 Jun 2008 00:52:40 GMT

Sure, here you go:

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/prod_white_paper0900aecd80191021.html

Regards

Farrukh

Re: Filtering only high alerts

5creedus — Thu, 12 Jun 2008 22:34:59 GMT

Thanks Farrukh