[NV-L] Best method to filter traps from specific IP addresses in ruleset

["Van Order, Drew \(US - Hermitage\)" <dvanorder@deloitte.com>]

Hi everyone,

Our customer has been receiving Peribit traps for a few weeks. It currently looks like this in the ruleset:

Trap Settings node for Peribit trap Enterprise ID (all traps highlighted) ----> Forward to TEC

Customer has requested that for just one of the traps, we only forward if it comes from 4 IP addresses, otherwise drop. I figure I will deselect this trap from the current Trap Settings node, then add a second Peribit Trap Settings node with just the one trap highlighted. It's after this step that I am wondering what will be most efficient.

I know I can create a SmartSet with just these 4 IP addresses, but understand SmartSet queries in rulesets are very expensive, and I don't want to compromise performance since this is also our TEC_ITS ruleset. Is there a better way to do this w/o Smart Set query? I don't want to create a TEC rule for this, I think it's smarter to do it closest to the trap source.

Thanks!---Drew

Drew Van Order
Information Technology Services
Deloitte Services LP
Tel: +1 615 882 7836
www.deloitte.com

This message (including any attachments) contains confidential information intended for a specific individual and purpose, and is protected by law.  If you are not the intended recipient, you should delete this message. 

Any disclosure, copying, or distribution of this message, or the taking of any action based on it, is strictly prohibited. [v.E.1]

_______________________________________________
NV-L mailing list
NV-L@lists.ca.ibm.com
Unsubscribe:NV-L-leave@lists.ca.ibm.com
http://lists.ca.ibm.com/mailman/listinfo/nv-l (Browser access limited to 
internal IBM'ers only)