7-46
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter 7 Defining Signatures
Creating Custom Signatures
sensor(config-sig-sig-ale-fir-yes)# summary-threshold 200
Step 9
Exit alert frequency submode.
sensor(config-sig-sig-ale-fir-yes)# exit
sensor(config-sig-sig-ale-fir)# exit
sensor(config-sig-sig-ale)# exit
Step 10
Configure the signature to apply anti-evasive deobfuscation before searching:
sensor(config-sig-sig)# engine service-http
sensor(config-sig-sig-ser)# de-obfuscate true
Step 11
Configure the Regex parameters.
sensor(config-sig-sig)# engine service-http
sensor(config-sig-sig-ser)# regex
sensor(config-sig-sig-ser-reg)# specify-uri-regex yes
sensor(config-sig-sig-ser-reg-yes)# uri-regex [Mm][Yy][Ff][Oo][Oo]
Step 12
Exit Regex submode.
sensor(config-sig-sig-ser-reg-yes)# exit
sensor(config-sig-sig-ser-reg-)# exit
Step 13
Configure the service ports using the signature variable WEBPORTS.
sensor(config-sig-sig-ser)# service-ports $WEBPORTS
Step 14
Exit signature definition submode.
sensor(config-sig-sig-ser)# exit
sensor(config-sig-sig)# exit
sensor(config-sig)# exit
Apply Changes:?[yes]:
Step 15
Press Enter to apply the changes or enter
no
to discard them.
Example Meta Engine Signature
Caution
A large number of Meta engine signatures could adversely affect overall sensor performa nce.
The Meta engine defines events that occur in a related manner within a sliding time interval. This engine
processes events rather than packets. As signature events are generated, the Meta engine inspects them
to determine if they matc h any or several Meta definitions. The Meta engine genera tes a signature event
after all requirements for the event are met.
All signature events are handed off to the Meta engine by the Signature Event Action Processor. The
Signature Event Action Processor hands off the event after processing the minimum hits option.
Summarization and event action are processed after the Meta engine has processed the component
events.