Malicious Call Identification
• Malicious Call Identification Overview, page 1
• Malicious Call Identification Prerequisites, page 1
• Malicious Call Identification Configuration Task Flow, page 2
• Malicious Call Identification Interactions and Restrictions, page 9
• Malicious Call ID Troubleshooting, page 11
Malicious Call Identification Overview
You can configure the Malicious Call Identification (MCID) feature to track troublesome or threatening calls.
Users can report these calls by requesting that Cisco Unified Communications Manager identify and register
the source of the incoming call in the network.
When the MCID feature is configured, the following actions take place:
1 The user receives a threatening call and presses Malicious call (or enters the feature code *39 if using a
POTS phone that is connected to an SCCP gateway).
2 Cisco Unified Communications Manager sends the user a confirmation tone and a text message, if the
phone has a display, to acknowledge receiving the MCID notification.
3 Cisco Unified Communications Manager updates the call details record (CDR) for the call with an indication
that the call is registered as a malicious call.
4 Cisco Unified Communications Manager generates the alarm and local syslogs entry that contains the
event information.
5 Cisco Unified Communications Manager sends an MCID invocation through the facility message to the
connected network. The facility information element (IE) encodes the MCID invocation.
6 After receiving this notification, the PSTN or other connected network can take actions, such as providing
legal authorities with the call information.
Malicious Call Identification Prerequisites
• Gateways and connections that support MCID:
◦PRI gateways that use the MGCP PRI backhaul interface for T1 (NI2) and E1 (ETSI) connections
Feature Configuration Guide for Cisco Unified Communications Manager, Release 12.0(1)
1
Malicious Call Identification
Malicious Call Identification Configuration Task Flow
◦H.323 trunks and gateways
• IP Phones that support MCID
Malicious Call Identification Configuration Task Flow
Before You Begin
• Review Malicious Call Identification Prerequisites, on page 1
Procedure
Command or Action
Purpose
Step 1
Generate a Phone Feature List
Generate a report to identify devices that support the
MCID feature.
Step 2
Set Malicious Call ID Service Parameter, Enable Cisco Unified Communications Manager to
on page 3
flag a call detail record (CDR) with the MCID
indicator.
Step 3
Configure Malicious Call ID Alarms, on Configure alarms to ensure that alarm information
page 3
displays in the system logs.
Step 4
Configure a Softkey Template for
Malicious Call Identification, on page 4
Step 5
Step 6
Configure a softkey template with MCID.
Note
The Cisco Unified IP Phones 8900 and 9900
Series support MCID with feature button
only.
To Associate a Softkey Template with a
Optional. To make the softkey template available to
Common Device Configuration, on page phones, you must complete either this step or the
5, complete the following subtasks:
following step. Follow this step if your system uses a
Common Device Configuration to apply
• Add a Softkey Template to a
configuration options to phones. This is the most
Common Device Configuration, on
commonly used method for making a softkey template
page 6
available to phones.
• Associate a Common Device
Configuration with a Phone, on page
6
Associate a Softkey Template with a
Phone, on page 7
Optional. Use this procedure either as an alternative
to associating the softkey template with the Common
Device Configuration, or in conjunction with the
Common Device Configuration. Use this procedure in
conjunction with the Common Device Configuration
if you need assign a softkey template that overrides
the assignment in the Common Device Configuration
or any other default softkey assignment.
Feature Configuration Guide for Cisco Unified Communications Manager, Release 12.0(1)
2
Malicious Call Identification
Set Malicious Call ID Service Parameter
Command or Action
Step 7
Purpose
To Configure Malicious Call Identification Perform this step to add and configure the MCID
Button, on page 7, complete the
button to a phone.
following subtasks:
• Configure Malicious Call ID Phone
Button Template, on page 8
• Associate a Button Template with a
Phone , on page 9
Set Malicious Call ID Service Parameter
To enable Cisco Unified Communications Manager to flag a CDR with the MCID indicator, you must enable
the CDR flag.
Before You Begin
Generate a Phone Feature List
Procedure
Step 1
Step 2
Step 3
From Cisco Unified CM Administration, choose System > Service Parameters.
From the Server drop-down list, choose the Cisco Unified Communications Manager server name.
From the Service drop-down list, choose Cisco CallManager.
The Service Parameter Configuration window displays.
Step 4
Step 5
In the System area, set the CDR Enabled Flag field to True.
Click Save.
What to Do Next
Configure Malicious Call ID Alarms, on page 3
Configure Malicious Call ID Alarms
In the Local Syslogs, you must set the alarm event level and activate alarms for MCID.
Before You Begin
Set Malicious Call ID Service Parameter, on page 3
Feature Configuration Guide for Cisco Unified Communications Manager, Release 12.0(1)
3
Malicious Call Identification
Configure a Softkey Template for Malicious Call Identification
Procedure
Step 1
From Cisco Unified Serviceability, choose Alarm > Configuration.
The Alarm Configuration window displays.
Step 2
Step 3
From the Server drop-down list, choose the Cisco Unified Communications Manager server and click Go.
From the Service Group drop-down list, choose CM Services. The Alarm Configuration window updates
with configuration fields.
From the Service drop-down list, choose Cisco CallManager.
Under Local Syslogs, in the Alarm Event Level drop-down list, choose Informational.
The Alarm Configuration window updates with configuration fields.
Step 4
Step 5
Step 6
Step 7
Step 8
Under Local Syslogs, check the Enable Alarm check box.
If you want to enable the alarm for all nodes in the cluster, check the Apply to All Nodes check box.
To turn on the informational alarm, click Update.
What to Do Next
Configure a Softkey Template for Malicious Call Identification, on page 4
Configure a Softkey Template for Malicious Call Identification
Note
Skinny Client Control Protocol (SCCP) IP phones use a softkey to invoke the MCID feature.
Before You Begin
Configure Malicious Call ID Alarms, on page 3
Procedure
Step 1
From Cisco Unified CM Administration, choose Device > Device Settings > Softkey Template.
The Softkey Template Configuration window appears.
Step 2
Perform this step to create a new softkey template; otherwise, proceed to the next step.
a) Click Add New.
b) Select a default template and click Copy.
c) In the Softkey Template Name field, enter a new name for the template.
d) Click Save.
Step 3
Perform this step to add softkeys to an existing template.
a) Enter search criteria and click Find.
b) Choose an existing template.
The Softkey Template Configuration window appears.
Step 4
Check the Default Softkey Template check box to designate this softkey template as the default softkey
template.
Feature Configuration Guide for Cisco Unified Communications Manager, Release 12.0(1)
4
Malicious Call Identification
Associate a Softkey Template with a Common Device Configuration
If you designate a softkey template as the default softkey template, you cannot delete it unless you
first remove the default designation.
Choose Configure Softkey Layout from the Related Links drop-down list in the upper right corner and
click Go.
In the Select a call state to configure field, choose Connected.
The list of Unselected Softkeys changes to display the available softkeys for this call state.
In the Unselected Softkeys drop-down list, choose Toggle Malicious Call Trace (MCID).
From the Unselected Softkeys list, choose the softkey to add and click the right arrow to move the softkey
to the Selected Softkeys list. Use the up and down arrows to change the position of the new softkey.
Click Save.
Note
Step 5
Step 6
Step 7
Step 8
Step 9
What to Do Next
(Optional) Configure a Softkey Template for Malicious Call Identification, on page 4 or Configure Malicious
Call Identification Button, on page 7
Associate a Softkey Template with a Common Device Configuration
Optional. There are two ways to associate a softkey template with a phone:
• Add the softkey template to the Phone Configuration.
• Add the softkey template to the Common Device Configuration.
The procedures in this section describe how to associate the softkey template with a Common Device
Configuration. Follow these procedures if your system uses a Common Device Configuration to apply
configuration options to phones. This is the most commonly used method for making a softkey template
available to phones.
To use the alternative method, see Associate a Softkey Template with a Phone, on page 7.
Before You Begin
Configure a Softkey Template for Malicious Call Identification, on page 4
Procedure
Command or Action
Step 1
Add a Softkey Template to a Common Device Configuration, on page
6
Step 2
Associate a Common Device Configuration with a Phone, on page 6
Purpose
Feature Configuration Guide for Cisco Unified Communications Manager, Release 12.0(1)
5
Malicious Call Identification
Associate a Softkey Template with a Common Device Configuration
Add a Softkey Template to a Common Device Configuration
Before You Begin
Configure a Softkey Template for Malicious Call Identification, on page 4
Procedure
Step 1
From Cisco Unified CM Administration, choose Device > Device Settings > Common Device Configuration.
The Find and List Common Device Configuration window appears.
Step 2
Perform this step to create a new Common Device Configuration and associate the softkey template with it;
otherwise, proceed to the next step.
a) Click Add New.
b) In the Name field, enter a name for the Common Device Configuration.
c) Click Save.
Step 3
Perform this step to add the softkey template to an existing Common Device Configuration.
a) Enter search criteria and click Find.
b) Choose an existing Common Device Configuration.
The Common Device Configuration window appears.
Step 4
In the Softkey Template drop-down list, choose the softkey template that contains the softkey that you want
to make available.
Click Save.
Perform one of the following tasks:
Step 5
Step 6
• If you created a new Common Device Configuration, associate the configuration with devices and then
restart them. See the What to Do Next section for more information.
• If you modified a Common Device Configuration that is already associated with devices, click Apply
Config to restart the devices.
What to Do Next
Associate a Common Device Configuration with a Phone
Associate a Common Device Configuration with a Phone
Before You Begin
Add a Softkey Template to a Common Device Configuration, on page 6
Procedure
Step 1
From Cisco Unified CM Administration, choose Device > Phone.
Feature Configuration Guide for Cisco Unified Communications Manager, Release 12.0(1)
6
Malicious Call Identification
Associate a Softkey Template with a Phone
The Find and List Phones window appears.
Step 2
Step 3
Step 4
Step 5
Find the phone to which to add the softkey template.
From the Common Device Configuration drop-down list, choose the common device configuration that
contains the new softkey template.
Click Save.
Click Reset to update the phone settings.
Associate a Softkey Template with a Phone
This procedure is optional. You can use this procedure as an alternative to associating the softkey template
with the Common Device Configuration. This procedure also works in conjunction with the Common Device
Configuration: use it when you need to assign a softkey template that overrides the assignment in the Common
Device Configuration or any other default softkey assignment.
Procedure
Step 1
From Cisco Unified CM Administration, choose Device > Phone.
The Find and List Phones window appears.
Step 2
Choose the phone to which you want to add the softkey template.
The Phone Configuration window appears.
Step 3
Step 4
Step 5
From the Softkey Template drop-down list, choose the template that contains the new softkey.
Click Save.
Press Reset to update the phone settings.
Configure Malicious Call Identification Button
The procedures in this section describe how to configure the Malicious Call Identification button.
Before You Begin
Configure Malicious Call ID Alarms, on page 3
Procedure
Command or Action
Step 1
Purpose
Configure Malicious Call ID Phone Button Perform this step to assign Malicious Call
Template, on page 8.
Identification button features to line or speed dial
keys.
Feature Configuration Guide for Cisco Unified Communications Manager, Release 12.0(1)
7
Malicious Call Identification
Configure Malicious Call Identification Button
Command or Action
Step 2
Purpose
Associate a Button Template with a Phone Perform this step to configure the Malicious Call
, on page 9
Identification button for a phone.
Configure Malicious Call ID Phone Button Template
Before You Begin
Configure Malicious Call ID Alarms, on page 3
Procedure
Step 1
From Cisco Unified CM Administration, choose Device > Device Settings > Phone Button Template.
The Find and List Phone Button Templates window appears.
Step 2
Click Find.
The window displays a list of templates for the supported phones.
Perform this step if you want to create a new phone button template; otherwise, proceed to the next step.
a) Select a default template for the model of phone and click Copy.
b) In the Phone Button Template Information field, enter a new name for the template.
c) Click Save.
Step 3
Step 4
Perform this step if you want to add phone buttons to an existing template.
a) Enter search criteria and click Find .
b) Choose an existing template.
The Phone Button Template Configuration window appears.
Step 5
Step 6
Step 7
From the Line drop-down list, choose feature that you want to add to the template.
Click Save.
Perform one of the following tasks:
• If you modified a template that is already associated with devices, click Apply Config to restart the
devices.
• If you created a new softkey template, associate the template with the devices and then restart them. See
the What to Do Next section for more information.
What to Do Next
Associate a Button Template with a Phone , on page 9
Feature Configuration Guide for Cisco Unified Communications Manager, Release 12.0(1)
8
Malicious Call Identification
Malicious Call Identification Interactions and Restrictions
Associate a Button Template with a Phone
Before You Begin
Configure Malicious Call ID Phone Button Template, on page 8
Procedure
Step 1
From Cisco Unified CM Administration, choose Device > Phone.
The Find and List Phones window is displayed.
Step 2
From the Find and List Phones window, click Find.
A list of phones that are configured on the Cisco Unified Communications Manager is displayed.
Choose the phone to which you want to add the phone button template.
The Phone Configuration window appears.
Step 3
Step 4
Step 5
In the Phone Button Template drop-down list, choose the phone button template that contains the new feature
button.
Click Save.
A dialog box is displayed with a message to press Reset to update the phone settings.
Malicious Call Identification Interactions and Restrictions
Malicious Call Identification Interactions
Table 1: Malicious Call Identification Interactions
Feature
Interaction
Conference Calls
When a user is connected to a conference, the user
can use the MCID feature to flag the call as a
malicious call. Cisco Unified Communications
Manager sends the MCID indication to the user,
generates the alarm, and updates the CDR. However,
Cisco Unified Communications Manager does not
send an MCID invoke message to the connected
network that might be involved in the conference.
Extension Mobility
Extension Mobility users can have the MCID softkey
as part of their user device profile and can use this
feature when they are logged on to a phone.
Feature Configuration Guide for Cisco Unified Communications Manager, Release 12.0(1)
9
Malicious Call Identification
Malicious Call Identification Interactions
Feature
Interaction
Call Detail Records
To track malicious calls by using CDR, you must set
the CDR Enabled Flag to True in the Cisco
CallManager service parameter. When the MCID
feature is used during a call, the CDR for the call
contains CallFlag=MALICIOUS in the Comment
field.
Alarms
To record alarms for the MCID feature in the Local
Syslogs, you must configure alarms in Cisco Unified
Serviceability. Under Local Syslogs, enable alarms
for the Informational alarm event level.
When the MCID feature is used during a call, the
system logs an SDL trace and a Cisco Unified
Communications Manager trace in alarms. You can
view the Alarm Event Log by using Cisco Unified
Serviceability. The traces provide the following
information:
• Date and time
• Type of event: Information
• Information: The Malicious Call Identification
feature is invoked in Cisco Unified
Communications Manager
• Called Party Number
• Called Device Name
• Called Display Name
• Calling Party Number
• Calling Device Name
• Calling Display Name
• Application ID
• Cluster ID
• Node ID
For more information about alarms and traces, see
the Cisco Unified Serviceability Administration Guide
at http://www.cisco.com/c/en/us/support/
unified-communications/
unified-communications-manager-callmanager/
products-maintenance-guides-list.html.
Cisco ATA 186 analog phone ports
The Cisco ATA 186 analog phone ports support
MCID by using the feature code (*39).
Feature Configuration Guide for Cisco Unified Communications Manager, Release 12.0(1)
10
Malicious Call Identification
Malicious Call Identification Restrictions
Malicious Call Identification Restrictions
Table 2: Malicious Call Identification Restrictions
Feature
Restriction
Malicious Call Identification Terminating (MCID-T) Cisco Unified Communications Manager supports
function
only the malicious call identification originating
function (MCID-O). Cisco Unified Communications
Manager does not support the malicious call
identification terminating function (MCID-T). If
Cisco Unified Communications Manager receives a
notification from the network of a malicious call
identification, Cisco Unified Communications
Manager ignores the notification.
Intercluster trunks
MCID does not work across intercluster trunks
because Cisco Unified Communications Manager
does not support the MCID-T function.
Cisco MGCP FXS gateways
Cisco MGCP FXS gateways do not support MCID.
No mechanism exists for accepting the hookflash and
collecting the feature code in MGCP.
QSIG trunks
MCID does not work over QSIG trunks because
MCID is not a QSIG standard.
Cisco VG248 Analog Phone Gateway
Cisco VG248 Analog Phone Gateway does not
support MCID.
SIP trunks
MCID does not support SIP trunks.
Immediate Divert
System does not support using MCID and Immediate
Divert features together.
Malicious Call ID Troubleshooting
To track and troubleshoot Malicious Call ID, you can use Cisco Unified Communications Manager SDL
traces and alarms. For information about setting traps and traces for MCID, see the Cisco Unified Serviceability
Administration Guide. For information about how to generate reports for MCID, see the Cisco Unified CDR
Analysis and Reporting Administration Guide.
Feature Configuration Guide for Cisco Unified Communications Manager, Release 12.0(1)
11
Malicious Call Identification
Malicious Call ID Troubleshooting
Feature Configuration Guide for Cisco Unified Communications Manager, Release 12.0(1)
12
Download PDF
Similar pages