Cisco Systems CL-28826-01 Configuring Signatures

38-4

User Guide for Cisco Security Manager 4.4

OL-28826-01

Chapter 38 Defining IPS Signatures

Configuring Signatures

IPS signature purge now runs at midnight every day.

Configuring Signatures

The Signatures policy is where you configure signatures for Cisco IPS sensors and Cisco IOS IPS

devices.

This section contains the following topics:

•Signatures Page, page 38-4

•Viewing Signature Update Levels, page38-9

•Enabling and Disabling Signatures, page 38-10

•Editing Signatures, page 38-11

•Adding Custom Signatures, page 38-16

•Cloning Signatures, page 38-18

•Editing Signature Parameters (Tuning Signatures), page38-19

Use the Signatures page to display the signature summary table, in which you can add, edit, and delete

IPS signatures. From this page you can tune the active signature set in a policy by enabling or disabling

signatures. You can also use this page to unload signatures from the engine.

Tips

•Disabled signatures are shown with hash marks covering the table row. When you deploy the

configuration, disabled signatures are removed from the device. For more information, see Enabling

and Disabling Signatures, page 38-10.

•For many columns, you can right-click the column and edit the property directly. Your edits apply

to all rows that you have selected. If you select multiple rows, the options that you can select are

limited to those that are valid for all selected rows. The contents of the right-click menu differ based

on the cell that you right click. For more information on the available commands, see Signature

Shortcut Menu, page 38-7.

Navigation Path

•(Device view) Select IPS > Signatures > Signatures from the Policy selector.

•(Policy view, IPS appliances and service modules) Select IPS > Signatures > Signatures, then

select an existing policy or create a new one.

•(Policy view, Cisco IOS IPS devices) Select IPS (Router) > Signatures, then select an existing

policy or create a new one.