Example Service.http Signature - Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual

Creating Custom Signatures

Example SERVICE.HTTP Signature

The following example demonstrates how to create a custom SERVICE.HTTP signature.
The following options apply to the SERVICE.HTTP engine:
•
•
•
•
•
•
•
•
To create a custom signature based on the SERVICE.HTTP engine, follow these steps:
Log in to the CLI using an account with administrator or operator privileges.
Step 1
Enter signature definition submode:
Step 2
sensor# configure terminal
sensor(config)# service signature-definition sig0
Specify a signature ID and a subsignature ID for the signature:
Step 3
sensor(config-sig)# signatures 63000 0
Custom signatures are in the range of 60000 to 65000.
Enter signature description mode:
Step 4
sensor(config-sig-sig)# sig-description
Specify a signature name:
Step 5
sensor(config-sig-sig-sig)# sig-name myWebSig
Specify the alert traits:
Step 6
sensor(config-sig-sig-sig)# alert-traits 2
The valid range is from 0 to 65535.
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
7-32
de-obfuscate [true | false]—Applies anti-evasive deobfuscation before searching.
default—Sets the value back to the system default setting.
event-action —Action(s) to perform when alert is triggered.
max-field-sizes —Grouping for maximum field sizes:
specify-max-arg-field-length [yes | no]—Enables max-arg-field-length (optional).
–
specify-max-header-field-length [yes | no]—Enables max-header-field-length (optional).
–
specify-max-request-length [yes | no]—Enables max-request-length (optional).
–
specify-max-uri-field-length [yes | no]—Enables max-uri-field-length (optional).
–
no—Removes an entry or selection setting.
regex—Regular expression grouping:
specify-arg-name-regex—Enables arg-name-regex (optional).
–
– specify-header-regex —Enables header-regex (optional).
– specify-request-regex—Enables request-regex (optional).
– specify-uri-regex—Enables uri-regex (optional).
service-ports —A comma-separated list of ports or port ranges where the target service may reside.
swap-attacker-victim [true | false]—Whether address (and ports) source and destination are
swapped in the alarm message. The default is false for no swapping.
Chapter 7 Defining Signatures
78-16527-01