7-48
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter 7 Defining Signatures
Creating Custom Signatures
•
all-not-components-required {true | false}—Specifies to use all of the NOT components.
•
swap-attacker-victim {true | false}—Swaps the attacker and victim addresses and ports (source
and destination) in the alert message and in any actions taken.
•
meta-reset-interval—Specifies the time in seconds to reset the Meta signature. The valid range is
0 to 3600 seconds. The default is 60 seconds.
•
meta-key—Specifies the storage type for the Meta signature:
–
AaBb—Attacker and victim addresses and ports.
–
AxBx—Attacker and victim addresses.
–
Axxx—Attacker address.
–
xxBx—Victim address.
•
unique-victim-ports—Specifies the number of unique victims ports required per Meta signature.
The valid range is 1 to 256.
•
event-action —Specifies the action(s) to perform when an alert is triggered:
–
deny-attacker-inline (inline only)—Does not transmit this packet and future packets from the
attacker address for a specified period of time.
–
deny-attacker-service-pair-inline (inline only)—Does not transmit this packet and future
packets on the attacker address victim port pair for a specified period of time.
–
deny-attacker-victim-pair-inline (inline only)—Does not transmit this packet and future
packets on the attacker/victim address pair for a specified period of time.
–
deny-connection-inline (inline only)—Does not transmit this packet and future packets on the
TCP flow.
–
deny-packet-inline (inline only)—Does not transmit this packet.
–
log-attacker-packets—Starts IP logging of packets containing the attacker address.
–
log-pair-packets—Starts IP logging of packets containing the attacker-victim address pair.
–
log-victim-packets—Starts IP logging of packets containing the victim address.
–
produce-alert —Writes the event to the Event Store as an alert.
–
produce-verbose-alert—Includes an encoded dump (possibly truncated) of the offending
packet in the alert.
–
request-block-connection—Sends a request to the ARC to block this connection.
–
request-block-host—Sends a request to the ARC to block this attacker host.
–
request-rate-limit—Sends a rate limit request to the ARC to perform rate limiting.
–
request-snmp-trap—Sends a request to the Notification Application component of the sensor
to perform SNMP notification.
–
reset-tcp-connection—Sends TCP resets to hijack and terminate the TCP flow.
–
modify-packet-inline— Modifies packet data to remove ambi guity about what the end point
might do with the packet.
Note
Signature 64000 subsignature 0 will fire when it sees the alerts from signature 1000 subsignature 0 and
signature 1001 subsignature 0 on the same source address. The source address selection is a result of the
meta key default value of Axxx. You can change the behavior by changing the meta key setting to xxBx
(destination address) for example.