Tune IPS Signature

[alkabeer80]

Hi,

I want to to tune IPS signature so that it can make exception of ip addresses.

the signature is 13004 (this is UDP scan signature) i have ciscoworks in my network which scan the network using UDP i dont want to disable the signature i just want to add the ip address of ciscoworks to safe list ( if it exists) i have configured the alert to be sent to my email and i got alot of those emails which says

high 13004-0 "AD - External UDP Scanner" x.y.z.w/src_port(*) 0.0.0.0/dest_port(*)

thanks

[rhermes · Accepted solution]

Alakabeer -

You want to configure an Event Action Rule for this signature with the IP address of your Ciscoworks host in the Event Action Variable:

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_event_action_rules.html#wp1032319

- Bob