topic Re: IDIOM or SDEE in Network Security https://community.cisco.com/t5/network-security/idiom-or-sdee/m-p/601876#M90149 <HTML><HEAD></HEAD><BODY><P>There is a big difference in the way vms2.3 fetches the events from a v4 sensor as compared with a v5 sensor</P><P></P><P>Version 4 uses</P><P>last request method = GET</P><P>last request URI = cgi-bin/event-server</P><P></P><P>The signature part that contains the subsigid looks like this:</P><P><SIGNATURE signame="Netsky Virus Activity" sigid="3136" subsigid="9" version="S90">Netsky.AB .pif</SIGNATURE></P><P></P><P>Version 5 uses</P><P>last request method = GET</P><P>last request URI = cgi-bin/sdee-server</P><P></P><P>The signature part that contains the subsigid looks like this:</P><P>- <SIGNATURE description="Netsky Virus Activity" id="3136" version="S90"></SIGNATURE></P><P> <SUBSIGID>9</SUBSIGID> </P><P></P><P></P><P>Is this configurable? </P><P>Are alerts that come from v5 sensor stored in both the sdee server as well as the event server? </P><P></P><P>The issues that I have is the sub signature is not reported correctly on the console of SecMon for an SDEE event and as a work around I work like to revert to using the event server</P></BODY></HTML> Wed, 05 Apr 2006 15:12:47 GMT darin.marais 2006-04-05T15:12:47Z IDIOM or SDEE https://community.cisco.com/t5/network-security/idiom-or-sdee/m-p/601875#M90146 <P>What determines whether the alarm type is collected by secmon as IDIOM or SDEE. </P><P></P><P>I have some Version 5.1(1p1)S222.0 sensors that appear under alarm type IDIOM and some Version 5.1(1p1)S222.0 sensors the show up as SDEE on the SecMon 2.2 console.</P><P></P><P>How do you configure the alarm type for a sensor?</P><P></P><P>Thanks in advance.</P> Sun, 10 Mar 2019 09:57:31 GMT https://community.cisco.com/t5/network-security/idiom-or-sdee/m-p/601875#M90146 darin.marais 2019-03-10T09:57:31Z Re: IDIOM or SDEE https://community.cisco.com/t5/network-security/idiom-or-sdee/m-p/601876#M90149 <HTML><HEAD></HEAD><BODY><P>There is a big difference in the way vms2.3 fetches the events from a v4 sensor as compared with a v5 sensor</P><P></P><P>Version 4 uses</P><P>last request method = GET</P><P>last request URI = cgi-bin/event-server</P><P></P><P>The signature part that contains the subsigid looks like this:</P><P><SIGNATURE signame="Netsky Virus Activity" sigid="3136" subsigid="9" version="S90">Netsky.AB .pif</SIGNATURE></P><P></P><P>Version 5 uses</P><P>last request method = GET</P><P>last request URI = cgi-bin/sdee-server</P><P></P><P>The signature part that contains the subsigid looks like this:</P><P>- <SIGNATURE description="Netsky Virus Activity" id="3136" version="S90"></SIGNATURE></P><P> <SUBSIGID>9</SUBSIGID> </P><P></P><P></P><P>Is this configurable? </P><P>Are alerts that come from v5 sensor stored in both the sdee server as well as the event server? </P><P></P><P>The issues that I have is the sub signature is not reported correctly on the console of SecMon for an SDEE event and as a work around I work like to revert to using the event server</P></BODY></HTML> Wed, 05 Apr 2006 15:12:47 GMT https://community.cisco.com/t5/network-security/idiom-or-sdee/m-p/601876#M90149 darin.marais 2006-04-05T15:12:47Z