Filtering verbose alerts

Question

Greetings all. I'm having some difficulties implementing event filters for a 4215 running 5.0.4.
1. I've globally enabled verbose alerting via the CLI by doing
# service event-action-rules rules0
# overrides produce-verbose-alert
2. I want to filter 'TCP SYN Port Sweep' (3002 0) so it doesn't get logged to the idsEventStore. I've created the following single filter,
# service event-action-rules rules0
# filters insert foo begin
# signature-id 3002
# subsignature-id-range 0-10
# actions-to-remove produce-verbose-alert
# filter-item-status Enabled
# stop-on-match True
I save my changes and when running local scans I see the event still being logged but WITHOUT the triggerPacket info. OK, I edit the rule and change to
# actions-to-remove produce-alert
run scans again and the event appears in the idsEventStore WITH the triggerPacket.
It appears I have to create two identical filter rules, first one with
# actions-to-remove produce-verbose-alert
next one with,
# actions-to-remove produce-alert
in order to completely filter 'TCP SYN Port Sweep' from the idsEventStore and I don't see it. So my question to the group is,
How does one create a single event filter rule to drop verbose alerts? Note: I need to have produce-verbose-alert set globally for troubleshooting.
Thanks in advance for the assistance.

Answer 1

When creating a filter you can specify multiple actions to remove. In IDM you hold down the control key to select each additional action. In IDM I think you put a "|" between each action you want to remove: "produceAlert|produceVerboseAlert".
You will need to use the one filter to remove All actions that produce any kind of alert.
So you need to remove the following actions at a minimum:
produceAlert
produceVerboseAlert
requestSnmpTrap
logAttackerPackets
logVictimPackets
logPairPackets
The last 5 actions above will force an alert to be produced Even if produceAlert has been filtered out. So you have to remove them as well. This is sort of stated in the IDM guide:
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids11/idmguide/dmevtrul.htm#wp1062278
But was not made clear in the CLI guide.
If you want to prevent all the actions (including those that don't produce an alert) then enter every action in the actions to remove section.
(NOTE: This is much easier to do in IDM. You select the top action, Hold down Shift key, and select the last action, and all the actions will be selected for removal).
It sounds like you are not interested in the 3002 signature at all. If this is the case, then the simplest thing to do is to just Disable the signature, and not worry about the filters.
The filters shoudl really only be used if you want to filter for specific address ranges, or want to filter out some but not all of the actions.
If you want to filter out All actions for All ip addresses, then just Disable the signature instead.
It will save on internal processing within the sensor.