Enterasys Intrusion Prevention System Manual page 158

Creating Custom Signatures
5. If desired, assign a severity to the signature from the Score pull-down menu. The score can be
used by a Security Information Manager (SIM) such as the Enterasys Security Information and
Event Manager.
6. Select the Event Group to assign the signature from the Classification drop-down list. For
more information about Event Groups, see
7. For basic signatures, in the Direction group, configure:
a.
b. Traffic direction, which refer to the direction of flow with respect to the protected
8. In the Signature Protocol group, specify the protocol to which the signature applies. TCP is
the default. If you select Other, enter the protocol number. Refer to
list of common protocol numbers.
3-16 Creating Network Sensor Signatures
Service direction, which refers to the signature port. Select:
- any if the signature should match packets with either or both destination and source
ports that match the configured Signature Port value. any can be used to watch traffic
in both directions. (default)
- source if the signature should match packets with a source port that matches the
configured Signature Port value. Typically, source is used for packets originating from
the server.
- destination if the signature should match packets with a destination port that
matches the configured Signature Port value. Typically, destination is used for
packets directed to a well known port on a server.
- both if the signature should match packets with both a source and destination port
that matches the configured Signature Port value.
network defined on the virtual sensor. Select:
- any to apply the signature to all traffic (default).
- toward to apply the signature to traffic toward the protected network.
- from to apply the signature to traffic originating from the protected network.
- internal to apply the signature to traffic that is entirely internal to the protected
network. That is, both source and destination are located within the protected
network.
- external to apply the signature to traffic that is entirely external to the protected
network. That is, both source and destination are located outside the protected
network.
Note: Any values you configure for Direction on this tab page will be superseded by values
configured on the Extended Settings tab page.
Note: Any value you configure for Protocol on this tab page will be superseded by values
configured on the Extended Network Layer tab page.
Event Group Descriptions on page 1-11.
Table 2-2 on page 2-11 for a