7-49
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter7 Defining Signatures
Creating Custom Signatures
Creating a Meta Engine Signature
To create a signature based on the Meta engine, follow these steps:
Step 1
Log in to the CLI using an account with administrator or operator privileges.
Step 2
Enter signature definition submode.
sensor# configure terminal
sensor(config)# service signature-definition sig1
Step 3
Specify a signature ID and a subsignature ID for the signature. Custom signatures are in the range of
60000 to 65000.
sensor(config-sig)# signatures 64000 0
Step 4
Specify the signature engine.
sensor(config-sig-sig)# engine meta
Step 5
Insert a signature (named m1) at the beginning of the list.
sensor(config-sig-sig-met)# component-list insert m1 begin
Step 6
Specify the signature ID of the signature on which to match this component.
sensor(config-sig-sig-met-com)# component-sig-id 1000
Step 7
Exit component list submode.
sensor(config-sig-sig-met-com)# exit
Step 8
Insert another signature (named m2) at the end of the list.
sensor(config-sig-sig-met)# component-list insert m2 end
Step 9
Specify the signature ID of the signature on which to match this component.
sensor(config-sig-sig-met-com)# component-sig-id 1001
Step 10
Configure the component list not to fire in order.
sensor(config-sig-sig-met-com)# component-list-in-order false
Step 11
Specify to use all components you have created.
sensor(config-sig-sig-met-com)# all-components-required true
Step 12
Specify not to use all of the NOT components.
sensor(config-sig-sig-met-com)# all-not-components-required false
Step 13
Verify the settings.
sensor(config-sig-sig-met-com)# exit
sensor-128(config-sig-sig-met)# show settings
meta
-----------------------------------------------
event-action: produce-alert <defaulted>
swap-attacker-victim: false <defaulted>
meta-reset-interval: 60 <defaulted>
component-list (ordered min: 1, max: 32, current: 2 - 2 active, 0 inactive)
-----------------------------------------------
ACTIVE list-contents
-----------------------------------------------
NAME: m1
-----------------------------------------------