Filter
Top Products
Chapter 27 Cisco IOS IPS
Edit IPS
27-32
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Edit IPS: SEAP Configuration: Event Action Filters
Event action filters let Cisco IOS IPS perform individual actions in response to an
event without requiring it to perform all actions or remove the entire event. Filters
work by removing actions from an event. A filter that removes all actions from an
event effectively consumes the event. Event action filters are processed as an
ordered list. You can move filters up or down in the list to have the router process
one filter before it processes other filters.
The Event Action Filters window displays the configured event action filters, and
allows you to reorder the filters list so that Cisco IOS IPS processes the filters in
the order that you want.
Use Event Action Filters
Check Use Event Action Filters to enable the use of event action filters. You can
add, edit, and remove event action filters, and rearrange the list to specify the
order that the router processes the filters whether or not event action filtering is
enabled.
Event Action Filter List Area
For a description of the columns in the Event Action Filter List area, see Add or
Edit an Event Action Filter.
Event Action Filter List Buttons
The Event Action Filter List buttons allow you to create, edit, and remove event
action filters, and to place each event action filter in the order you want it to be in
the list. The buttons are described in the following sections.
Select All
The Select All button works with the Enable, Disable, and Delete buttons. To
enable or disable all event action filters, click Select All, and then click Enable
or Disable. To remove all event action filters, click Select All, and then click
Delete.
Add
Click the Add button to add an event action filter to the end of the list. A dialog
is displayed that enables you to enter the data for the filter.