About h-schupp

h-schupp · 02-15-2008

Reference: "Configure E-mail Notifications with Scripts for IDS Alerts Using CiscoWorks Monitoring Center for Security"http://www.cisco.com/en/US/customer/products/hw/vpndevc/ps4077/products_configuration_example09186a00801fc770.shtml#fivesensorGood ...

h-schupp · 02-14-2008

Good day - Rebuilt a VMS 2.3 from scratch yesterday - loaded all the updates for common services, IDSMC to v2.2, DST Patches, etc. Placed the IDSMC Sig and Engine upgrades into the updates directory and, before trying to import the sensors, installed...

h-schupp · 02-11-2008

While I have experience with the 42xx sensor appliances I have not previously worked with the nm-cids modules. I have been told though that they are limited to use about 100 signatures. From their talk about memory and cpu restrictions it made sens...

h-schupp · 02-08-2008

Good day all. I have been asked to re-create some functionality that was lost after the customer upgraded from VMS to CSM but without CS-MARS or any other event monitor. The user had the system set to generate an email when an event was fired. It a...

h-schupp · 09-06-2007

The description is the same as well. Should this be a SubSig instead?

h-schupp · 02-21-2008

This one solved itself and the notifications now contain all the variable data expected. Don't know what fixed the issue but the server running VMS was restarted later that day at some point after I sent the post for this problem. Since the reboot i...

h-schupp · 02-15-2008

I re-applied the SecMon 2.2 patches and now all seems to be working fine again. A mystery to me!

h-schupp · 02-11-2008

Thank you for a concise yet complete answer to my question(s). I will make sure I make myself knowledgable about the new AIM-IPS modules. Do you have any insight (just have you heard anything concrete) as to whether they are going to be making any ...

h-schupp · 02-11-2008

Marcoa -Thanks very much! I knew about IEV but I didn't know about IEV being included in CSM now. It looks like it was included starting with CSM 3.1. Still, the IEV solution fails for my customer due to the 5 sensor limit.The customers are staying...

h-schupp · 09-07-2007

We are seeing the same issue for 5894-1 on our DNS traffic. Given that the sig appears to simply look for one of several hex combos (regex = \xe3[\x0a-\x0f])occuring in any UDP session... it is not really unexpected that there will be quite a few 'r...

Member Since	‎11-20-2002 08:07 AM
Date Last Visited	‎08-18-2017 03:50 AM
Posts	14
Total Helpful Votes Received	3

User Statistics

User Activity

VMS Security Monitor Event Rules - Email Script Question

VMS IDSMC Out-of-Sync for Engine Version

NM-CIDS - 100 Signature limit?

IPS Sensor - Event Notification via Email?

S300 Signature Set - Adds SigID 5874 - Appears to duplicate SigID 5873

Re: VMS Security Monitor Event Rules - Email Script Question

Re: VMS IDSMC Out-of-Sync for Engine Version

Re: NM-CIDS - 100 Signature limit?

Re: IPS Sensor - Event Notification via Email?

Re: sig 5894 - subsig 0 -> false positives