Writing A Filter Rule - Enterasys Intrusion Prevention System Manual

Writing a Filter Rule

A Dragon filter consists of an event name and filter rules, which are created using keywords and
operators.
Event Names
Events generated by signatures have the same name as the signature. For example, events
generated when traffic matches the signature named RLOGIN:ROOT will also be named
RLOGIN:ROOT. The names and descriptions of internal events generated by policy settings are
listed in the document Sensor Internal Events at this link:
https://dragon.enterasys.com/downloads/docs/SensorInternalEvents.htm
Keywords and Operators
The keywords used in Dragon filters are listed in
Table 2-4 Dragon Filter Keywords
Keyword
host
srchost
dsthost
port
srcport
dstport
net
srcnet
dstnet
tcp
udp
icmp
The operators used in Dragon filters include and, or, and not.
Keyword rules and operators can be nested, by using parentheses to define precedence order.
Usage Notes
Although the Dragon filters are very powerful, please note the following constraints:
• Precedence of multiple operators must be defined using parentheses. If more than one
operator is used in a rule, any operators that are not nested will produce unpredictable
results. See
• Do not wrap atomic items with parentheses. For example, (net 10.0.0.0/8) is incorrect usage.
Example
host 10.100.100.10
srchost 10.100.100.1
dsthost 10.100.100.205
port 1234
srcport 80
dstport 6000
net 10.100.100.0/24
srcnet 10.100.100.0/24
dstnet 10.100.100.0/24
tcp
udp
icmp
Examples of Dragon Filter Rules
Configuring the Dragon Filter Module
Table 2-4:
Description
Will match Source IP and Destination IP
Will only match the Source IP
Will only match the Destination IP
Will match both Source or Destination ports
Will only match on the Source port
Will only match on the Destination port
Will match on the specified CIDR block
Will only match against the source IP
Will only match against the destination IP
Will match the TCP protocol
Will match the UDP protocol
Will match the ICMP protocol
below for examples of precedence.
Creating Network Sensor Policies and Signatures 2-25