| [ LiB ] |
IDS signature EventActions take one or all of the following actions: TCP reset ( Reset ), IP log ( Log ), block host ( ShunHost ), block connection ( ShunConnection ), or ZERO .
Pre-block ACL Entries that the sensor will place at the beginning of the new ACL before any sensor blocking entries.
Post-block ACL ACL entries that the sensor should place after the sensor blocking entries.
Flood signature engine Used to detect attempts to cause DoS.
Sweep signature engine Used to detect network reconnaissance traffic.
Services signature engine Uses Layers 5, 6, and 7 and are operating systemindependent.
Trojan signature engine Cannot be used to create custom signatures.
Protected parameters Cannot be changed for the default signatures. However, they can be changed for custom signatures.
Required parameters Must be defined for all signatures, both default and custom.
Master parameters Common to most signatures and exist in most signature engines.
Local signature parameters Engine-specific.
Regular expressions searching for the text "Secret" or "secret" use the syntax [Ss]ecret .
The PortRange parameter with a value of ZERO means that all ports will be inspected.
Signature engine Atomic.L3.IP can be used to detect attacks which make use of routing protocols such as Border Gateway Protocol (BGP) and Enhanced Interior Gateway Routing Protocol (EIGRP) at layer 3.
Automatic IP logging captures entire IP packets into a log file. It is not enabled by default and must be configured.
| [ LiB ] |
| [ LiB ] |
You can install Security Monitor without IDS MC. It only needs CiscoWorks Common Services.
Security Monitor can communicate with RDEP IDS, PostOffice IDS, IOS IDS, Host IDS, and PIX Firewalls.
You can manually add devices or import them from IDS MC into Security Monitor.
| [ LiB ] |
| [ LiB ] |
To log in to IDS MC, you must log in to CiscoWorks at http://192.168.1.1:1741. The default username and password for CiscoWorks is admin , admin .
IDS MC recommends Netscape 4.79 or Internet Explorer 5.5 with SP2 or higher as client browsers.
During installation, you must enter a new Sybase SQL database password. There is no default.
IDS MC processes:
IDS_Analyzer
Defines event rules and
IDS_Backup
IDS_DbAdminAnalyzer Periodically applies active database rules to the current state of the server.
IDS_DeployDaemon Manages all configuration deployments.
IDS_Notifier
Retrieves notification requests from other subsystems and performs the
IDS_Receiver Receives Cisco IDS alarms and syslog security events and stores them in the database.
IDS_ReportScheduler
Generates all scheduled
You use the Discover Settings check box on the Add Sensor screen for IDS MC to retrieve the sensor setting information. Make sure that you enter the correct sensor IP address, username, and password into IDS MC.
PuTTY Configuration A client utility used for Telnet or SSH host connections to an IDS sensor. You can use it to test new keys created with PuTTYgen.
PuTTYgen A utility used to generate public and private keys for RSA connections.
IDS MC directories:
\MDS IDS MC home directory.
\MDS\Apache Apache Web server.
\MDS\Sybase Sybase SQL database. Information is stored on IDS appliances and IDSMs in the Sybase SQL database.
\MDS\Tomcat Tomcat Server is the application server that dispatches servlets to the IDS MC from Common Services.
\MDS\etc\ids Where the IDS MC is stored.
\MDS\etc\ids\updates Where IDS updates signatures are stored for the IDS MC to update sensors or the IDS MC server itself.
| [ LiB ] |