Cisco SITCS 1.0: Cisco Intrusion Prevention Systems II

Course details

• The Cisco SensorBase correlates real-time data from more than 1.5 million devices around the world to create network reputation scores that enable Cisco IPS devices to block threats from known malicious hosts before they pass through the IPS inspection process. In this course, you'll learn how to describe some methodologies for tuning a Cisco IPS sensor to properly manage false positive and negative events, including the methods and configuration procedures to create custom signatures on a Cisco IPS sensor. In addition, you'll learn how to enable the anomaly detection functionality and the reputation-based feature on the Cisco IPS sensor. This course is one of a series in the SkillSoft learning path that covers the objectives for the Implementing Cisco Threat Control Solutions (SITCS) 1.0 (300-207 SITCS) exam.
• Topic T2 Objective O3
• start the course
• Topic T6 Objective O7
• describe false negative and false positive events
• Topic T10 Objective O11
• describe Cisco IPS tuning approaches
• Topic T14 Objective O15
• tune Cisco IPS to reduce false positives
• Topic T18 Objective O19
• reduce false positives by narrowing the search context and the header values, limiting the number of matched patterns, decreasing the attention span, and increasing the number of events
• Topic T22 Objective O23
• tune Cisco IPS to reduce false negatives
• Topic T26 Objective O27
• reduce false negatives by using IP reassembly, TCP reassembly, and deobfuscation
• Topic T31 Objective O32
• provide an overview of custom signatures
• Topic T35 Objective O36
• describe the configuration and procedure options in the Custom Signature wizard
• Topic T40 Objective O41
• describe the principles behind anomaly detection
• Topic T44 Objective O45
• describe scanners and histograms
• Topic T48 Objective O49
• describe anomaly detection and actions
• Topic T52 Objective O53
• describe an anomaly detection scenario
• Topic T56 Objective O57
• describe the anomaly detection configuration procedure
• Topic T60 Objective O61
• describe how to verify the operational mode and statistics of anomaly detection
• Topic T65 Objective O66
• describe the traffic processing flow in the IPS sensor Global Correlation and Reputation Filter active
• Topic T69 Objective O70
• describe global correlation operations
• Topic T73 Objective O74
• describe how the IPS sensors send in