You configure override for action, one override for one action, so yes, you right.
Best regards, Andrey On Tue, Apr 26, 2011 at 4:44 PM, Kingsley Charles < [email protected]> wrote: > Hi all > > When configuring Event Action Overrides, it seems that the "action" can be > associated to only one range of risk rating. In the following example, I > have configured RR range 70-100 for packet inline. > > Does that mean, I can't configure "deny packet inline" for other RR ranges. > This doesn't make sense to me. > > > sensor(config-eve)# sh settings > variables (min: 0, max: 256, current: 0) > ----------------------------------------------- > ----------------------------------------------- > overrides (min: 0, max: 15, current: 2) > ----------------------------------------------- > <protected entry> > action-to-add: deny-packet-inline > ----------------------------------------------- > override-item-status: Enabled default: Enabled > risk-rating-range: 70-100 default: 90-100 > > > With regards > Kings > > _______________________________________________ > For more information regarding industry leading CCIE Lab training, please > visit www.ipexpert.com > > Are you a CCNP or CCIE and looking for a job? Check out > www.PlatinumPlacement.com >
_______________________________________________ For more information regarding industry leading CCIE Lab training, please visit www.ipexpert.com Are you a CCNP or CCIE and looking for a job? Check out www.PlatinumPlacement.com
