topic Re: Looking for IDS/IPS event list in Network Security

Looking for IDS/IPS event list

gdntsoc — Sun, 10 Mar 2019 09:50:21 GMT

Could someone point me at a document repository that list all possible events which could be issued by a CISCO IDS NETWORK MODULE FOR CISCO 2800 SERIES ROUTERS (NM-CIDS-K9)

Thanks in advance,

Re: Looking for IDS/IPS event list

jlimbo — Fri, 13 Jan 2006 07:00:49 GMT

The NM-Module runs Sensor OS so the signatures available will depends on what Signature level you have applied. The latest signature version is S211.

All signatures available can be accessed here:

http://tools.cisco.com/MySDN/Intelligence/allSignatures.x

Re: Looking for IDS/IPS event list

gdntsoc — Fri, 13 Jan 2006 17:05:45 GMT

Just to confirm, this would mean that NM-Module would have the same events as a standalone appliance such as Cisco IDS-4215.

Re: Looking for IDS/IPS event list

marcabal — Fri, 13 Jan 2006 20:18:37 GMT

99% of the time yes when both are running the same version and sig level.

The less than 1% exception is because the IDS-4215 is capable of running in both Promiscuous and InLine mode, but the NM-CIDS is currently limited to InLine mode. So there are a small set of signatures on a IDS-4215 that will only fire when run in InLine mode, and so will not be seen on a NM-CIDS.