topic Re: Emailing events automatically in Network Security

Emailing events automatically

darin.marais — Sun, 10 Mar 2019 09:10:07 GMT

On VMS 2.2 with SecMon 1.2.3, the section admin/event rule allows you to send an email.

I have a requirement to send an email for various signatures when they are triggered on a particular sensor. The email should include the source and the destination address as well as the time, date and count etc.

I created a rule as follows

Rule Name: Rule

-----------------------------------------------

Comment: “signature description”

-----------------------------------------------

Active: yes

-----------------------------------------------

Filter: (Signature Name = “signature description”) AND

(Originating Device = abc) OR

(Originating Device = xyz)

-----------------------------------------------

Rule Actions:

Notify via Email:

Recipient(s): ----

Subject: Rule

Message: (Signature Name = “signature description”) AND

(Originating Device = abc) OR (Originating Device = xyz)

The following rule: ${RuleName}, has triggered ${MsgCount} times on the ${DateStr} ${TimeStr}

-----------------------------------------------

Thresholds and Intervals:

Issue action(s) after 3 event occurrences.

Repeat action(s) again after 5 event occurrences.

Reset count every 30 minutes.

Unfortunately it does not seam to work as I thought it would. Could anyone tell me if this is at all possible or even achievable with VMS?

The strange thing is that with this rule active, I receive emails even when the “signature description” has not even triggered.

Re: Emailing events automatically

didyap — Tue, 26 Oct 2004 20:41:47 GMT

The following link might help

http://www.cisco.com/en/US/products/sw/secursw/ps2113/products_configuration_example09186a00801fc770.shtml

Re: Emailing events automatically

jmmleung — Fri, 19 Nov 2004 01:58:15 GMT

The script in the suggested CCO tech doc. does not work when the filter rule contain IP address trigger condition. The trigger filter works fine, but the notification email contains empty content!

Any body has workarround, beside MOD the script?

Re: Emailing events automatically

gfullage — Tue, 23 Nov 2004 00:11:24 GMT

This is due to bug CSCed91589 (http://www.cisco.com/cgi-bin/Support/Bugtool/onebug.pl?bugid=CSCed91589&Submit=Search), unfortunately no workaround at the moment, it's to do with incompatible database entries and needs a major rework.

"Severity=High" will work fine, but "Severity=High AND SourceIPAddress=1.1.1.1" will not.

Re: Emailing events automatically

jmmleung — Tue, 23 Nov 2004 01:41:25 GMT

Many thanks for the BUG ID. U save my time on open up a TAC case 😉

BTW, seem this BUG is already identified for sometime, just wonder when DE will solved it. As the CWVMS is free of charge for 5 hosts now, more and more customer will encounter the problem.

Thanks again.

Re: Emailing events automatically

darin.marais — Thu, 03 Feb 2005 14:40:18 GMT

I currently make use of the script that is listed in this thread I would like to upgrade a system to version 2.01 of secmon/idsmc but after reading through the release note I noticed the following bug identification which appears to be applicable to the script.

Bug CSCsa12013 “Event Rules ${Query} keyword is incompatible with IdsAlarms in scripts”

There are currently no known workarounds for the problem. Could anyone from Cisco advise if there are any plans to fix it?

Re: Emailing events automatically

gfullage — Fri, 04 Feb 2005 00:05:39 GMT

This bug is the same as the aforementioned one in this thread. It was opened for v2.0 specifically so that it could be tracked and fixed in this release. It doesn't however, mean that the emailalert.pl script doesn't work in v2.0.

If you have it working currently on 1.2.x, then upgrading to v2.x will have no effect on the functionality of the script.

The above bug, and the similar bug opened on v1.2, deal with having more than one Event Filter defined. In other words, if you have just Severity=High then it'll work fine with v1.2 and v2.x. If you have Severity=High AND SourceAddress=1.1.1.1 then it won't work in either version.

As I said, if it's currently working for you in v1.2, then go ahead and upgrade and it'll keep working for you in v2.0