This document explains the process of the configuration of the Cisco
IPS Manager Express (IME) in order to send the email notification message
(alerts) when Event Rules are triggered by Cisco Intrusion Prevention System
There are no specific prerequisites for this document.
The information in this document is based on these software and
Cisco 4200 Series IPS Device that runs software version 6.0 and
Cisco IPS Manager Express (IME) version 6.1.1 and later
Note: While IME can be used to monitor sensor devices that run Cisco IPS
5.0 and later, some of the new features and functionality delivered in IME are
only supported on sensors that run Cisco IPS 6.1 or later.
The information in this document was created from the devices in a
specific lab environment. All of the devices used in this document started with
a cleared (default) configuration. If your network is live, make sure that you
understand the potential impact of any command.
This configuration can also be used with these sensors:
Refer to the
Technical Tips Conventions for more information on document
The Cisco Intrusion Prevention System (IPS) does not have the ability
to send e-mail alerts on its own. Cisco IPS Manager Express (IME) has the
ability to send e-mail notifications when an Event Rule is triggered. The
variables that can be used within the e-mail notification for each event
includes variables such as the Signature ID, the source and destination of the
alert, and many more.
In this section, you are presented with the information to configure
email notification with the Cisco IPS Manager Express.
Complete these steps in order to configure Email notifications using
Cisco IPS Manager Express:
Choose Tools > Preferences as shown in the
Now in the Preferences window that has opened, choose the
Notification tab. Make sure that the check box next to
Enable email/epage notifications is checked, which is a must
for the IME to send email notifications. Provide the required information in
the Mail Server, From Address, and Recipient Address(es) fields as shown in the
screen shot. In this example, the Mail Server used is
test.com, the From email Address used is
email@example.com and the Recipient email Address
Check one of the boxes next to High,
Medium, Low, or
Informational level alerts in order to choose the level for
which alerts has to sent . Also check the boxes next to the filed names
required in order choose the fields to be present in the notification mail. In
this example, the fields chosen are Sub Sig ID and Sig
Name. Then check the boxes next to send summarized
notifications and send detailed notifications as
shown in order to choose Notification Type. Then click
Click OK, and then click on send a Test
Mail button in order to check if the IME is able to send an email
alert according to the configuration. If an email is received by the recipients
configured then the configuration works fine.
This completes the email notification configuration
There is currently no specific troubleshooting information available
for this configuration.