7-3
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter7 Defining Signatures
Understanding Signatures
sensor#
Note
You cannot delete the default signature definition policy, sig0.
Step 7
Confirm the signature definition policy has been deleted.
sensor# list signature-definition-configurations
Signature Definition
Instance Size Virtual Sensor
sig0 255 vs0
temp 707 N/A
sig1 141 vs1
sensor#
Step 8
Reset a signature definition policy to factory settings.
sensor# configure terminal
sensor(config)# default service signature-definition sig1
sensor(config)#
For More Information
•
For the procedure for adding signature variables, see Configuring Signature Variables, page 7-4.
•
For the procedure for configuring the general settings, see Configuring Signatures, pa ge 7-6.
Understanding Signatures
Attacks or other misuses of network resources can be defined as network intrusions. Sensors that use a
signature-based technology can detect network intrusions. A signature is a set of rules that your sensor
uses to detect typical intrusive activity, such as DoS attacks. As sensors scan network packets, they use
signatures to detect known attacks and respond with actions that you de fine.
The sensor compares the list of signatures with network activity. When a match is found, the sensor takes
an action, such as logging the event or sending an alert. Sensors let you modify existing signatures and
define new ones.
Signature-based intrusion detection can produce false positives because certain normal network activity
can be misinterpreted as malicious activity. For example, some network applications or operating
systems may send out numerous ICMP messages, which a signature-based detection system might
interpret as an attempt by an attacker to map out a network segment. You can minimize false positives
by tuning your signatures.
To configure a sensor to monitor network traffic for a particular signature, you must enable the signature.
By default, the most critical signatures are enabled when you install the signature update. When an attack
is detected that matches an enabled signature, the sensor generates an alert, which is stored in the Event
Store of the sensor. The alerts, as well as other events, may be retrieved from the Event Store by
web-based clients. By default the sensor logs all Informational alerts or higher.
Some signatures have subsignatures, that is, the signature is divided into subcategories. When you
configure a subsignature, changes made to the parameters of one subsignature apply only to that
subsignature. For example, if you edit signature 3050 subsignature 1 and change the severity, the severity
change applies to only subsignature 1 and not to 3050 2, 305 0 3, and 3050 4.