User's Manual

Security Services
Intrusion Prevention Service
Cisco ISA500 Series Integrated Security Appliance Administrator Guide 219
7
For example, if you choose BitTorrent, only the signatures under the
BitTorrent application are displayed. To display all signatures, choose All.
• Search by Signature ID: Allows you to view a specific signature by
searching the signature ID. Enter the signature ID in this field, and then click
Search. To display all categories, click Reset.
• Expand/Collapse: To expand the signatures under an IM or P2P application,
click the + button. To hide the signatures, click the - button.
STEP 3 Specify the setting for all signatures under an IM or P2P application or for a single
signature:
• Disabled: Choose this option to disable checking attacks.
• Detect Only: Click this option to check the attacks and to log a message
when an attack is detected. This option is mostly used for troubleshooting
purposes.
• Detect and Prevent: Click this option to check the attacks, and to log a
message and drop the packet when an attack is detected.
To log the IPS events, you first need to choose Detect Only or Detect and
Prevent for the IM or P2P applications, and then go to the Device
Management -> Loggings pages to configure the log settings and log
facilities:
- To save the IPS logs in the lcoal syslog daemon, you need to enable the
Log feature, set the log buffer size and the severity for local log, and then
check the Local Log box for the IM/P2P Blocking log facility.
- To save the IPS logs to the remote syslog server if you have a remote
syslog server support, you need to enable the Log feature, specify the
Remote Log settings, and check the Remote Log box for the IM/P2P
Blocking log facility.
For more information about how to configure the log settings and log
facilities, and how to view the logs, see Log Management, page 302.
• Email Alert Threshold: Enter the value of the email alert threshold. When the
hit count is over the email alert threshold, an alert email is sent to the
specified email acount.
To send the IPS alert emails to the specified email accont, you first need to
enable the IPS Alert feature and configure the email account settings, see
Configuring the Email Alert Settings, page 316.