Filter
Top Products
B-34
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Appendix B Signature Engines
Meta Engine
All signature events are handed off to the Meta engine by the Signature Event Action Processor. The
Signature Event Action Processor hands off the event after processing the minimum hits option.
Summarization and event action are processed after the Meta engine has processed the component
events.
Table B-15 lists the parameters specific to the Meta engine.
Table B-15 Meta Engine Parameters
Parameter Description Value
component-list Specifies the Meta engine component:
•
edit—Edits an existing entry.
•
insert—Inserts a new entry into the list:
–
begin—Places the entry at the beginning
of the active list.
–
end—Places the entry at the end of the
active list.
–
inactive—Places the entry into the
inactive list.
–
before—Places the entry before the
specified entry.
–
after—Places the entry after the
specified entry.
•
move—Moves an entry in the list.
•
component-count—Specifies the number of
times component must fire before this
component is satisfied
•
component-sig-id—Specifies the signature
ID of the signature to match this component
on.
•
component-subsig-id—Specifies the
subsignature ID of the signature to match
this component on.
•
is-not-component—Specifies that the
component is a NOT component.
name1
true | false
component-list-in-order Specifies to fire the component list in order. true | false
all-components-required Specifies to use all components. true | false
all-not-components-required Specifies to use all of the NOT components. true | false
swap-attacker-victim Swaps the attacker and victim addresses and
ports (source and destination) in the alert
message and in any actions taken.
true| false (default)
meta-reset-interval Specifies the time in seconds to reset the Meta
signature.
0 to 3600