Configuring General Signature Parameters - Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual

Configuring Signatures
•
•
•
•

Configuring General Signature Parameters

The following options apply to configuring the general parameters of a specific signature:
•
•
•
•
•
We do not recommend that you change the promisc-delta setting for a signature.
Caution
•
•
•
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
7-4
Configuring AIC Signatures, page 7-12
IP Fragment Reassembly, page 7-22
Configuring TCP Stream Reassembly, page 7-24
Configuring IP Logging, page 7-28
alert-frequency—Sets the summary options for grouping alerts.
For the procedure, see Configuring Alert Frequency, page
alert-severity—Sets the severity of the alert.
For the procedure, see Configuring Alert Severity, page
engine—Specifies the signature engine. You can assign actions when you are in the engine
submode.
For more information about signature engines, see
procedure for assigning actions, see
event-counter—Sets the event count.
For the procedure, see Configuring Event Counter, page
promisc-delta—The delta value used to determine the seriousness of the alert.
Promiscuous delta lowers the RR of certain alerts in promiscuous mode. Because the sensor does
not know the attributes of the target system and in promiscuous mode cannot deny packets, it is
useful to lower the prioritization of promiscuous alerts (based on the lower RR) so the administrator
can focus on investigating higher RR alerts.
In inline mode, the sensor can deny the offending packets and they never reach the target host, so it
does not matter if the target was vulnerable. The attack was not allowed on the network and so we
do not subtract from the RR value.
Signatures that are not service, OS, or application specific have 0 for the promiscuously delta. If the
signature is specific to an OS, service, or application, it has a promiscuous delta of 5, 10, or 15
calculated from 5 points for each category.
sig-description—Your description of the signature.
sig-fidelity-rating—Rating of the fidelity of signature.
For the procedure, see Configuring Signature Fidelity Rating, page
status—Sets the status of the signature to enabled or retired.
For the procedure, see Configuring the Status of Signatures, page
7-5.
7-6.
Appendix B, "Signature Engines."
Assigning Actions to Signatures, page
7-8.
Chapter 7 Defining Signatures
For the
7-11.
7-9.
7-10.
78-16527-01