Customizing sensor from filtering false alarms.

[spbalakrishnan]

hi,

How can i filter the false alarms coming out from my dhcp server and dns servers. Iam getting a lot of frag overlap signature alarms.Can anyone help me to avoid these false alarms ? Please help.

[edadios]

Hi,

You cna configure event action filter for those host you do not want the sensor to do any further action for the specific signatures.

This is described here : http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids12/idmguide/dmevtrul.htm#wp1063299

I hope this helps you.