RDEP and SDEE

gdntsoc — Sun, 10 Mar 2019 09:21:36 GMT

Greetings all. I'm continuing to educate myself about RDEP and SDEE so apologies in advance if my understanding is not the greatest.

We have custom apps which pull events from a Cisco 4235 appliance (v 5.0) via RDEP. Some members of my group are also interested in using third-party apps to read/view the same events via SDEE. My question to the forum is....

Is it possible to read/view events from a v5.0 sensor using both technologies/formats simultaneously? or are they mutually exclusive? Thank you.

Re: RDEP and SDEE

marcabal — Tue, 29 Mar 2005 18:59:14 GMT

The sensor can serve out events in both formats simultaneously.

Version 4.x sensors stored events in the older RDEPv1 format, and could only server events with the older RDEPv1 format.

Version 5.x sensors instead store events in the newer SDEE/CIDEE format, and will natively serve out these events in the SDEE/CIDEE format using the sdee-server web service.

However, to ensure compatibility with systems designed for 4.x with the RDEPv1 format, a converter was also included with the 5.x sensor. When the event-server web service is connected to (instead of the sdee-server web service) the sensor will automatically internally convert the natively stored SDEE/CIDEE formatted alarms into the older RDEPv1 format and serve them out.

So yes a RDEPv1 style client can connect and receive events from the sensor at the same time that a new SDEE/CIDEE style client connects and receives events from the sensor.

NOTE: CIDEE contains the Cisco specific parameters that are added on to the standard SDEE format. SDEE/CIDEE may also be referred to as RDEPv2 format.

Specifications are available for download from:

http://www.cisco.com/cgi-bin/dev_support/access_level/product_support?pcgi=1&product=IDS_INT_API

topic Re: RDEP and SDEE in Network Security

RDEP and SDEE

Re: RDEP and SDEE