IPS monitoring Events Notes

[learnsec]

Dear all,

I have a group of IPS/IDS installed in our network monitoring multiple segments.

Usually, and for years I do find always events with matching severity high or medium in addition to low and informational.

From around two months and till now, while monitoring those IPS/IDS I noticed that I am not finding any event with severity High or Medium although before there was daily logs with the high & Medium Severity and all the group of IPS / IDS is affected with the same behavior not only on one device.

I will be happy if everything is running normally with no matching severity, but I am afraid that there is something wrong with the monitoring of our IPS /IDS Systems.

I find logs with low and informational severity only.

Please advise if I can do any troubleshooting

Regards,

[rhermes]

I will assume you have not changed anything on your sensors to explain this difference. It can be accounted for by the normal signature update process. Cisco will phase out (retire) or modify old or poorly performing signatures (prone to false positives) over time. In order to test this idea, take some of the old medium and high severity signature that used to fire and check what their current setting are in your sensors. If they're retired or have been updated, this may account for the difference.

- Bob

[learnsec]

Can u please clarify what kind of updates / modifications on ips config may lead to such circumstances?

Ips config may be changed but nothing related to such behavior.

Thank you for you response,

[rhermes · Accepted solution]

Software updates also contain a signature update. Any signature update applied to an IPS sensor will modify the sensor's existing signature settings. New signatures will be enabled and existing signatures may be altered to provide better performance or retired if they have out lived their usefullness.

The sensor's configuration can be changed to affect what signatures fire as well by configuring event action filters and event action overrides.

- Bob