Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual page 6

Contents
Defining Signatures
7
C H A P T E R
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
vi
Configuring the General Settings
Clearing the Denied Attackers List
Event Action Rules Example
7-1
About Signatures
7-1
Signature Variables
7-2
About Signature Variables
Configuring Signature Variables
Configuring Signatures
7-3
Configuring General Signature Parameters
Configuring Alert Frequency
Configuring Alert Severity
Configuring Event Counter
Configuring Signature Fidelity Rating
Configuring the Status of Signatures
Assigning Actions to Signatures
Configuring AIC Signatures
Overview
7-12
Configuring the Application Policy
AIC Request Method Signatures
AIC MIME Define Content Type Signatures
AIC Transfer Encoding Signatures
AIC FTP Commands Signatures
IP Fragment Reassembly
Overview
7-22
Configuring IP Fragment Reassembly Parameters
Configuring the Method for IP Fragment Reassembly
Configuring TCP Stream Reassembly
Overview
7-24
Configuring TCP Stream Reassembly Parameters
Configuring the Mode for TCP Stream Reassembly
Configuring IP Logging
Creating Custom Signatures
Sequence for Creating a Custom Signature
Example STRING.TCP Signature
Example SERVICE.HTTP Signature
Example MEG Signature
Example AIC MIME-Type Signature
6-16
6-18
6-19
7-2
7-2
7-4
7-5
7-6
7-8
7-9
7-10
7-11
7-12
7-13
7-15
7-16
7-19
7-20
7-22
7-24
7-28
7-29
7-29
7-30
7-32
7-33
7-36
7-22
7-23
7-24
7-27
78-16527-01