McAfee® Host Intrusion Prevention 6.1 Product Guide | IPS Policies |
| IPS Rules policy details |
To modify the view of signatures:
4
Select... | To view... |
|
|
Show Active Signatures | Only the signatures that are active for the IPS Rules |
| policy. This is the default view. |
|
|
Show Disabled Signatures | Only the signatures whose severity level is set to |
| disabled. |
|
|
Show All Signatures | A combination of active and disabled signatures. |
|
|
Modifying host and network signatures
You can view and modify default signatures on the Signatures tab of the IPS Rules policy. This enables you to change the severity level of the signature if the signature is causing false positives.
To modify default signatures:
1
The Signature Properties dialog box appears.
2On the General tab, modify the Severity Level, Allow Client Exceptions, or Log Status settings, and enter notes in the Note box to document the change.
3On the Description tab, review what the signature is protecting and what it provides. If there is a link, click it to open a browser page and view more information on the security threat.
4Click OK.
You can modify the severity level of several signatures at one time by selecting the signatures and clicking Modify the Severity Level. In the dialog box that appears, select Modified and the new severity level to be applied to the signatures, or select Default to
return the signatures to their default severity level. Click OK to save the changes. Severity Level settings include High, Medium, Low, Information, and Disabled.
Creating custom signatures
Host Intrusion Prevention gives you the flexibility to create and manage your own signatures and share them between policies. Creating custom signatures, which is recommended only for advanced users, provides additional flexibility for your environment. Refer to Writing Custom Signatures on page 164 for details.
You can use two methods to create signatures:
Signature Creation Wizard — This is the simplest method, but you cannot change operations that the signature is protecting.
Standard Mode — This is the more advanced method that enables you to add or delete operations that the signature is protecting.
48
