7-4
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
Chapter 7 Defining Signatures
Configuring Signatures
•
Configuring AIC Signatures, page 7-12
•
IP Fragment Reassembly, page 7-22
•
Configuring TCP Stream Reassembly, page 7-24
•
Configuring IP Logging, page 7-28
Configuring General Signature Parameters
The following options apply to configuring the general parameters of a specific signature:
•
alert-frequency
—Sets the summary options for grouping alerts.
For the procedure, see
Configuring Alert Frequency, page 7-5
.
•
alert-severity
—Sets the severity of the alert.
For the procedure, see
Configuring Alert Severity, page 7-6
.
•
engine
—Specifies the signature engine. You can assign actions when you are in the engine
submode.
For more information about signature engines, see
Appendix B, “Signature Engines.”
For the
procedure for assigning actions, see
Assigning Actions to Signatures, page 7-11
.
•
event-counter
—Sets the event count.
For the procedure, see
Configuring Event Counter, page 7-8
.
•
promisc-delta
—The delta value used to determine the seriousness of the alert.
Caution
We do not recommend that you change the promisc-delta setting for a signature.
Promiscuous delta lowers the RR of certain alerts in promiscuous mode. Because the sensor does
not know the attributes of the target system and in promiscuous mode cannot deny packets, it is
useful to lower the prioritization of promiscuous alerts (based on the lower RR) so the administrator
can focus on investigating higher RR alerts.
In inline mode, the sensor can deny the offending packets and they never reach the target host, so it
does not matter if the target was vulnerable. The attack was not allowed on the network and so we
do not subtract from the RR value.
Signatures that are not service, OS, or application specific have 0 for the promiscuously delta. If the
signature is specific to an OS, service, or application, it has a promiscuous delta of 5, 10, or 15
calculated from 5 points for each category.
•
sig-description
—Your description of the signature.
•
sig-fidelity-rating
—Rating of the fidelity of signature.
For the procedure, see
Configuring Signature Fidelity Rating, page 7-9
.
•
status
—Sets the status of the signature to enabled or retired.
For the procedure, see
Configuring the Status of Signatures, page 7-10
.