Cisco Cisco IPS 4520 Sensor
68
Release Notes for Cisco Intrusion Prevention System 7.1(6)E4
OL-27710-01
Disabling Anomaly Detection
Disabling Anomaly Detection Using IDM or IME
To disable anomaly detection, follow these steps:
Step 1
Log in to IDM or IME using an account with administrator or operator privileges.
Step 2
Choose Configuration > Policies > IPS Policies.
Step 3
Select the virtual sensor for which you want to turn off anomaly detection, and then click Edit.
Step 4
Under Anomaly Detection, from the AD Operational Mode drop-down list, choose Inactive as the
anomaly detection mode.
anomaly detection mode.
Tip
To discard your changes and close the Edit Virtual Sensor dialog box, click Cancel.
Step 5
Click OK.
Tip
To discard your changes, click Reset.
Step 6
Click Apply to apply your changes and save the revised configuration.
For More Information
Disabling Anomaly Detection Using the CLI
If you have anomaly detection enabled and you have your sensor configured to see only one direction of
traffic, you should disable anomaly detection. Otherwise, you will receive many alerts, because anomaly
detection sees asymmetric traffic as having incomplete connections, that is, like worm scanners, and fires
alerts.
traffic, you should disable anomaly detection. Otherwise, you will receive many alerts, because anomaly
detection sees asymmetric traffic as having incomplete connections, that is, like worm scanners, and fires
alerts.
To disable anomaly detection, follow these steps:
Step 1
Log in to the CLI using an account with administrator privileges.
Step 2
Enter analysis engine submode.
sensor# configure terminal
sensor(config)# service analysis-engine
sensor(config-ana)#
Step 3
Enter the virtual sensor name that contains the anomaly detection policy you want to disable.
sensor(config-ana)# virtual-sensor vs0
sensor(config-ana-vir)#
Step 4
Disable anomaly detection operational mode.
sensor(config-ana-vir)# anomaly-detection
sensor(config-ana-vir-ano)# operational-mode inactive
sensor(config-ana-vir-ano)#