7-56
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter 7 Defining Signatures
Creating Custom Signatures
To create a custom signature based on the String XL TCP engine that searches for minimum match length
with stingy, dot all, and UTF-8 turned on, follow these steps:
Step 1
Log in to the CLI using an account with administrator or operator privileges.
Step 2
Enter signature definition submode.
sensor# configure terminal
sensor(config)# service signature-definition sig1
Step 3
Specify a signature ID and subsignature ID for the signa ture.
sensor(config-sig)# signatures 60004 0
Custom signatures are in the range of 60000 to 65000.
Step 4
Enter signature description submode.
sensor(config-sig-sig)# sig-description
Step 5
Specify a name for the new signature. You can also specify a additional comments about the sig using
the sig-comment command or additional information about the signature using the sig-string-info
command.
sensor(config-sig-sig-sig)# sig-name This is my new name
Step 6
Exit signature description submode.
sensor(config-sig-sig-sig)# exit
Step 7
Specify the String XL TCP engine.
sensor(config-sig-sig)# engine string-xl-tcp
Step 8
Specify the service ports.
sensor(config-sig-sig-str)# service-ports 80
Step 9
Specify the direction.
sensor(config-sig-sig-str)# direction to-service
Step 10
Change the event actions if needed according to your security policy by using the event-a ction
command. The default event action is produce-alert.
Step 11
Make sure raw regex is turned off:
sensor(config-sig-sig-str)# specify-raw-regex-string no
Note
Raw Regex is regular expression syntax used for raw mode processing. It is expert mode only
and targeted for use by the Cisco IPS signature development team or only those who are under
supervision by the Cisco IPS signature development team. You can configure a String XL
signature in either regular Regex or raw Regex.
Step 12
Specify the regex string to search for in the TCP packet with dot all turned on.
sensor(config-sig-sig-str-no)# regex-string ht+p[\r].
sensor(config-sig-sig-str-no)# dot-all true
Step 13
Specify a minimum match length for this signature that can only be used with stingy.
sensor(config-sig-sig-str-no)# specify-min-match-length yes
sensor(config-sig-sig-str-no-yes)# min-match-length 100