Create Named Audit Rules

Use the global configuration mode command ip audit name to create audit rules for info and attack signature types. Any signatures disabled with the ip audit signature command don’t become a part of the audit rule created with the ip audit name command. Use the no form of this command to delete an audit rule. The syntax is

Rtr1(config)ip audit name audit-name {info | attack} [list standard-acl] [action [alarm] [drop] [reset]]
Rtr1(config)no ip audit name audit-name {info | attack}

audit-name	The name for an audit specification.
info	Specifies that the audit rule is for info signatures.
attack	Specifies that the audit rule is for attack signatures.
list	Specifies an ACL to attach to the audit rule.
standard-acl	The integer representing an access control list. Use with the list keyword.
action	Sets an action for the info signature to take when a match occurs.
alarm	Sends an alarm to the console, IDS Director, or a Syslog server.
drop	Drops the packet.
reset	Resets the TCP session.

This command was introduced in IOS 12.0(5)T. The default action is alarm.

In this example, the default action for attack signatures is set to all three actions:

Rtr1(config)#ip audit attack action alarm drop reset

The following example creates an audit rule named Audit.99 for info signatures that’s configured with all three actions:

Rtr1(config)#ip audit name Audit.99 info action alarm drop reset

This example demonstrates disabling signature 1000 and then creating an info signature audit rule named Audit.33 that doesn’t include that signature:

Rtr1(config)#ip audit signature 1001 disable
Rtr1(config)#ip audit name Audit.33 info action alarm drop reset

Create Named Audit Rules

alperen