Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual page 153

Chapter 7 Defining Signatures
To create a MEG signature based on the META engine, follow these steps:
Log in to the CLI using an account with administrator or operator privileges.
Step 1
Enter signature definition submode:
Step 2
sensor# configure terminal
sensor(config)# service signature-definition sig0
Specify a signature ID and a subsignature ID for the signature:
Step 3
sensor(config-sig)# signatures 64000 0
Custom signatures are in the range of 60000 to 65000.
Specify the signature engine:
Step 4
sensor(config-sig-sig)# engine meta
Insert a MEG signature (named c1) at the beginning of the list:
Step 5
sensor(config-sig-sig-met)# component-list insert c1 begin
Specify the signature ID of the signature on which to match this component:
Step 6
sensor(config-sig-sig-met-com)# component-sig-id 2000
Exit component list submode:
Step 7
sensor(config-sig-sig-met-com)# exit
Step 8 Insert another MEG signature (named c2) at the end of the list:
sensor(config-sig-sig-met)# component-list insert c2 end
Step 9 Specify the signature ID of the signature on which to match this component
sensor(config-sig-sig-met-com)# component-sig-id 3000
Verify the settings:
Step 10
sensor(config-sig-sig-met-com)# exit
sensor(config-sig-sig-met)# show settings
meta
-----------------------------------------------
78-16527-01
event-action: produce-alert <defaulted>
meta-reset-interval: 60 <defaulted>
component-list (min: 1, max: 8, current: 2 - 2 active, 0 inactive)
-----------------------------------------------
ACTIVE list-contents
-----------------------------------------------
NAME: c1
-----------------------------------------------
component-sig-id: 2000
component-subsig-id: 0 <defaulted>
component-count: 1 <defaulted>
-----------------------------------------------
-----------------------------------------------
NAME: c2
-----------------------------------------------
component-sig-id: 3000
component-subsig-id: 0 <defaulted>
component-count: 1 <defaulted>
-----------------------------------------------
-----------------------------------------------
-----------------------------------------------
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
Creating Custom Signatures
7-35