Cisco Systems IPS4510K9 manual Creating a Meta Engine Signature

Chapter 7 Defining Signatures

Creating Custom Signatures

	Creating a Meta Engine Signature
	To create a signature based on the Meta engine, follow these steps:
Step 1	Log in to the CLI using an account with administrator or operator privileges.
Step 2	Enter signature definition submode.
	sensor# configure terminal
	sensor(config)# service signature-definition sig1
Step 3	Specify a signature ID and a subsignature ID for the signature. Custom signatures are in the range of
	60000 to 65000.
	sensor(config-sig)# signatures 64000 0
Step 4	Specify the signature engine.
	sensor(config-sig-sig)# engine meta
Step 5	Insert a signature (named m1) at the beginning of the list.
	sensor(config-sig-sig-met)#component-list insert m1 begin
Step 6	Specify the signature ID of the signature on which to match this component.
	sensor(config-sig-sig-met-com)# component-sig-id1000
Step 7	Exit component list submode.
	sensor(config-sig-sig-met-com)# exit
Step 8	Insert another signature (named m2) at the end of the list.
	sensor(config-sig-sig-met)# component-list insert m2 end
Step 9	Specify the signature ID of the signature on which to match this component.
	sensor(config-sig-sig-met-com)# component-sig-id 1001
Step 10	Configure the component list not to fire in order.
	sensor(config-sig-sig-met-com)# component-list-in-order false
Step 11	Specify to use all components you have created.
	sensor(config-sig-sig-met-com)# all-components-required true
Step 12	Specify not to use all of the NOT components.
	sensor(config-sig-sig-met-com)#all-not-components-required false
Step 13	Verify the settings.
	sensor(config-sig-sig-met-com)# exit
	sensor-128(config-sig-sig-met)# show settings
	meta
	-----------------------------------------------
	event-action: produce-alert <defaulted>
	swap-attacker-victim: false <defaulted>
	meta-reset-interval: 60 <defaulted>
	component-list (ordered min: 1, max: 32, current: 2 - 2 active, 0 inactive)
	-----------------------------------------------
	ACTIVE list-contents
	-----------------------------------------------
	NAME: m1
	-----------------------------------------------
	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		7-49