Enterasys Intrusion Prevention System Manual page 25

Network Sensor Signatures
Event Group Descriptions
This section describes all of the Enterasys IPS Event Groups. You may also create your own
custom Event Groups. Creating your own custom Event Groups is described in Chapter 3,
Creating Network Sensor Signatures.
Applications (APPS)
This category contains signatures for applications that are not suspicious or a form of misuse. A
signature may be placed in APPS if it is traffic that does not fit into MISUSE or SUSPICIOUS,
because the applications themselves are normally used in business (unlike P2P clients and other
apps).
ATTACKS
An ATTACK is an event that is most commonly generated from a potential "attacker" and is
destined to one or more "victims" (that is, in TCP, the establisher of a connection). The results of
an ATTACK may not always result in remote access to the end host. However, it will always have
the potential to compromise the integrity of the end system. This could come in the form of (but
not limited to) data leakage or modification, access loss (DoS), or actual remote access.
What doesn't belong there:
Any string that can be transmitted or seen in legal/normal traffic.
BETA
This category is used mostly for the converted signature set, but also contains any signature that
has been tested with Enterasys IPS, but not tested for all environments. Any signature of this type
is placed in this classification for a short time for customers to test.
COMPROMISE
A COMPROMISE is an event which generally comes from a "victim" to one or more potential
"attackers." Events in this category will be the direct result of something that would/should be in
any of the other categories, except VIRUS.
What doesn't belong there:
Any string that can be transmitted or seen in legal/normal traffic.
DYNAMIC
This category is for follow-on signatures, which are signatures that are applied to packets
captured as a result of another signature match.
FAILURES
This category is for signatures that detect errors sent from one host to another indicating that a
particular request could not be fulfilled.
LEGACY
Since signatures are never deleted, this category contains signatures that have been deprecated for
some reason.This category also includes old signatures that are false positive prone (for example,
maybe the application is no longer used). The signatures are kept in this category for historical
reference.
Creating Network Sensor Policies and Signatures 1-11