Filtering only high alerts

[5creedus]

I have a range of IP's that I never want to see any high priority alerts, but need to see any other alerts. How would I do that?

thanks

[Farrukh Haroon]

The best way to control this would be to filter those hosts based on the Risk Rating, using 'Event Action Filters' you can subtract actions from alerts. So for these hosts you could subtract the 'Product Alert' action based on a specific Risk Rating value.

Have a look at:

http://www.cisco.com/en/US/docs/security/ips/6.0/configuration/guide/idm/dmEvtRul.html#wp1034361

Regards

Farrukh

[5creedus]

thanks, more detailed information on the risk ratings?

[Farrukh Haroon · Accepted solution]

Sure, here you go:

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/prod_white_paper0900aecd80191021.html

Regards

Farrukh

[5creedus]

Thanks Farrukh