VMS secmon and Trigger Packet

[darin.marais]

Right, in the network is a VMS Server 2.3sp2 and several 5.1.5E1s283.0 sensors. We have enabled the following commands on the sensors:

overrides produce-verbose-alert

override-item-status Enabled

risk-rating-range 50

SDEE events are received in VMS SecMon console. In the past with this enabled, when the Risk Rating was above 50 on any event received in the console, this would produce a (verbose) trigger packet that would be viewable on the console by right clicking the event and the selecting tools/trigger packet. However it seams that this is not the case anymore.

Could someone tell me if this function still works or has something changed that makes it not possible anymore?

[rhermes]

Check to see if you are still reporting Risk Ratings on your events in SecMon. We have had some senor updates break Risk Ratings. Re-importing the sensor in VMS fixes that problem.

[darin.marais]

If I run show event on a sensor were I have enabled the commands:

overrides produce-verbose-alert

override-item-status Enabled

risk-rating-range 50

The event that is captured on the screen is as follows.

sensor# sh events

evIdsAlert: eventId=removed severity=high vendor=Cisco

originator:

hosted sensor

appName: sensorApp

appInstanceId: 5037

time: 2007/05/30 08:05:57 2007/05/30 10:05:57 CET

signature: description=Cursor/Icon File Format Buffer Overflow id=5442 version=S137

subsigId: 0

sigDetails: Malicious ANI File

interfaceGroup:

vlan: 0

participants:

attacker:

addr: locality=OUT removed

port: 8080

target:

addr: locality=OUT removed

port: 46531

context:

fromTarget:

text removed

fromAttacker:

text removed

riskRatingValue: 60

interface: ge2_0

protocol: tcp

The event includes the risk rating value. Is that what you mean?

In the past the events collected were IDIOM events but now the are SDEE. Is there a difference as far as the triggered packets are concerned. In the past the event included a section called triggerPacket but I don?t see that anymore.