how to tune sig parameters from IDS MC

[npham]

Through the IDS MC web interface, the only signature parameters I can edit are AlarmSeverity and EventAction. In order to tune other parameters, I have to go through IDM. The problem is, after a configuration deployment from IDS MC, these tuned parameters are over-written by the default settings from IDS MC.

I would like to know if it is possible to set these parameters manually by editing files on the IDS MC system. I notice there are some potential files contained in CSCOpx\MDC\etc\ids\xml\sig_data, however not all signatures are defined in those files. Perhaps the sig parameters are stored in one of the Sybase DBs?

Its become a real PITA managing an enterprise IDS through IDS MC because of its limitations.

[bernhard · Accepted solution]

To edit the engine parameters in IDSMC, click on the engine name.

[npham]

Thanks! I never bothered trying that on other sigs after clicking a few of the 99# ones and getting the response "Tuning of this signature engine is not currently supported."

I'm a little happier MC user again.