Showing results for 
Search instead for 
Did you mean: 

Can MARS filter based on something in the IPS trigger packet?



Does anyone know if MARS can filter alerts based on data in the trigger packet of an IPS alert?  We have a customer that is getting between 50 and 150 false positve Union Select SQL Injection alerts each day because they sell Sealy Union Select mattresses and each time there is a search on their site for this mattress this rule triggers.  We don't want to turn off that signature alltogether because we have seen a handful of legitimate alerts from it as well over the last couple of weeks so we still want to know about them.

If we could create a filter in MARS to drop the alert if it sees Sealy or Mattress in the trigger packet of the IPS alert that would cut an enourmous of wasted time out of the daily review of these alerts.  Anyone have any ideas?

2 Replies 2

Jennifer Halim
Cisco Employee
Cisco Employee

Yes, you can configure "drop rules" to drop false positive from IPS events.

Here is the URL for your reference:

Configuration guide for drop rules:

Hope that helps.

Thanks for the reply halijenn.

Unless I missed something I don't see anywhere in those two links where a drop can be configured based on text in the trigger packet of the IPS alert.  I know that drops can be configured for fields like source/destination IP/Port, and/or signature number, and such but I was wondering if the drop could be configured for the words that would show up in the trigger packet associated with the IPS alert.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers