Filter
Top Products
CHAPTER
10-1
Cisco Intrusion Prevention System CLI Sensor Configuration Guide for IPS 7.1
OL-19892-01
10
Configuring Global Correlation
This chapter provides information for configuring global correlation. It contains the following sections:
• Global Correlation Notes and Caveats, page 10-1
• Understanding Global Correlation, page 10-2
• Participating in the SensorBase Network, page 10-2
• Understanding Reputation, page 10-3
• Understanding Network Participation, page 10-4
• Understanding Efficacy, page 10-5
• Understanding Reputation and Risk Rating, page 10-6
• Global Correlation Features and Goals, page 10-6
• Global Correlation Requirements, page 10-7
• Understanding Global Correlation Sensor Health Metrics, page 10-8
• Configuring Global Correlation Inspection and Reputation Filtering, page 10-8
• Configuring Network Participation, page 10-11
• Troubleshooting Global Correlation, page 10-13
• Disabling Global Correlation, page 10-13
• Displaying Global Correlation Statistics, page 10-14
Global Correlation Notes and Caveats
The following notes and caveats apply to configuring global correlation:
• The global correlation features are supported in IPS 7.0 and later.
• As with signature updates, when the sensor applies a global correlation update, it may trigger
bypass. Whether or not bypass is triggered depends on the traffic load of the sensor and the size of
the signature/global correlation update. If bypass mode is turned off, an inline sensor stops passing
traffic while the update is being applied.
• Network participation requires a network connection to the Internet.
• Valid license—You must have a valid sensor license for global correlation features to function. You
can still configure and display statistics for the global correlation features, but the global correlation
databases are cleared and no updates are attempted. Once you install a valid license, the global
correlation features are reactivated.