method { Include GET }
time { Include * }
Executable { Include * }
user_name { Include * }
directives isapi:request
}
See
Windows custom signatures and Non-Windows custom signatures for an explanation of
the various sections and values.
Common sections
A rule’s most common sections and their values include the items below. For sections relevant
to the selected class section, see the class section under Windows or Non-Windows custom
signatures. The keywords
Include and Exclude are used for all sections except for tag, Id, level,
and directives. Include means that the section works on the value indicated, and Exclude means
that the section works on all values except the one indicated.
NOTE:
All section names on all platforms are case-sensitive. Values for sections are case-sensitive
on non-Windows platforms only.
Description
Value
Section
See
Windows custom signatures or Non-Windows
custom signatures.
Depends on operating system.
Indicates the class this rule
applies to.
Class
Name of the subrule.
Name of the rule in quotes "..."
tag
The unique ID number of the signature. The
numbers are the ones available for custom rules.
4000 - 5999
Id
The severity level of the signature:
0=Disabled
0
1
level
1=Log
2
2=Low
3
3= Medium
4
4= High
The users to whom the rule applies. Specify
particular users or all users.
{Include/Exclude user's name or
system account}
user_name
Remarks for Windows:
•
For local user: use <machine name>/<local
user name>.
•
For domain user: use <domain
name>/<domain user name>.
•
For local system: use Local/System.
•
Some remotely initiated actions do not
report the ID of the remote user, but use
the local service and its user context
instead. You need to plan accordingly when
developing rules. When a process occurs in
the context of a Null Session, the user and
domain are ‘Anonymous’. If a rule applies
to all users, use *. On UNIX, this section is
case sensitive.
Appendix A — Writing Custom Signatures and Exceptions
Rule structure
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5
102