Cisco Systems IPS4510K9 Working With Signature Definition Policies

7-2
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter 7 Defining Signatures
Working With Signature Definition Policies
Working With Signature Definition Policies
Use the service signature-definition name command in service signature definition mode to create a
signature definition policy. The values of this signature definition policy are the same as the default
signature definition policy, sig0, until you edit them.
Or you can use the copy signature-definition source_destination command in privileged EXEC mode
to make a copy of an existing policy and then edit the values of the new policy as needed.
Use the list signature-definition-configurations command in privileged EXEC mode to list the
signature definition policies.
Use the no service signature-definition name command in global configuration mode to delete a
signature definition policy. Use the default service signature-definition name command in global
configuration mode to reset the signature definition policy to factory settings.
Creating, Copying, Editing, and Deleting Signature Definition Policies
To create, copy, edit, and delete signature definition policies, follow these steps:
Step 1 Log in to the CLI using an account with administrator privileges.
Step 2 Create a signature definition policy.
sensor# configure terminal
sensor(config)# service signature-definition MySig
Editing new instance MySig.
sensor(config-sig)# exit
Apply Changes?[yes]: yes
sensor(config)# exit
Step 3 Or copy an existing signature definition policy to a new signature definition policy.
sensor# copy signature-definition sig0 sig1
sensor#
Note You receive an error if the policy already exists or if there is not enough space available for the
new policy.
Step 4 Accept the default signature definition policy values or edit the following parameters:
a. Add signature definition variables.
b. Configure the general signature options.
Step 5 Display a list of signature definition policies on the sensor.
sensor# list signature-definition-configurations
Signature Definition
Instance Size Virtual Sensor
sig0 255 vs0
temp 707 N/A
MySig 255 N/A
sig1 141 vs1
sensor#
Step 6 Delete a signature definition policy.
sensor# configure terminal
sensor(config)# no service signature-definition MySig
sensor(config)# exit