exclude destination address from sig

[dglosser]

New to Cisco IPS....

I wish to EXCLUDE a single destination IP address from a signature -- have the sig fire it it trips for all BUT one IP address (which is a confirmed false positive).

The sig name is BO2K-UDP. want to have it ignore events for a single destination but have it trip normally for all other destinations. Thanks.

[rhermes]

You want to set up an Event Action Filter.

Here's the 6.0 version:

http://www.cisco.com/en/US/docs/security/ips/6.0/configuration/guide/cli/cliEvAct.html

[dglosser]

thank you for for your quick reply... must this be done via CLI or can it be done in the GUI? Thanks.