Configuring Alerts on IPS - 4240

[Kevin Melton]

I was reading the the Online Help within the IPS 4240 Menu. I wanted to know how to configure alerts. I found a section that basically takes you to the Signature definition screen, allows one to pick a specific signature, and then set alerts based on Event Count or Attacker Address. I was unable to find where on the IPS 4240 to configure alerts to go either to email or a Pager.... is this an option? Is the only option Trap Generation?

Thanks

Kevin

[marcabal]

The sensor itself is only able to generate alerts into it's local eventStore (which can then queried by management stations like IEV, or CSMARS) and SNMP Traps. The sensor itself is not able to send email or pager alerts.

Instead for email alerts the functionality is built into IEV 5.2 (and I believe is also in CS MARS).

The emails can be sent to you, or if your pager supports receiving emails then they can be sent to your pager.

The email notification feature is new in IEV 5.2 if I remember right. So try loading IEV 5.2 and seeing what it's notification capabilities are.

http://www.cisco.com/cgi-bin/tablebuild.pl/ips-ev

NOTE: IEV 5.2 is available at no additional charge to users with active Cisco Service for IPS maintenance contracts on their sensors.

If you have CS MARS already, then you might want to look to see what notifications CS MARS supports.