configure "reset" for all default signatures

[mylove142]

Hi all,

When I update signature (all default signature by Cisco), I want to configure "action: reset" for all default signatures (all default signatures that are turned on) . If you know how to do that, please answer me.

Thank you very much.

Duy Khang

[mhellman]

Do you mean after each sig update? You can go into the sig configuration and do a "select by" release. you will get a drop-down box of releases, select the appropriate release. You can then sort by enabled. select multiple sigs at a time by using the shift key. now click the actions button to change multiple sigs at once.

[scothrel]

The quickest way to do this is to apply an "event action override" to add the reset action to all alarms.

[mhellman]

hmmm...that's a good idea. What effect does that have on components of a meta sig that normally wouldn't create an alarm?

[mylove142]

That is a good idea. However, I don't know how to assign "log, reset" action to many default signatures. Please guide me step by step. I use Cisco VMS to manage IDSM-2.

Thank you very much.

Duy Khang