D-Link NetDefend DFL-210 User Manual page 143

6.3.7. IDP Actions
The group type is one of the values IDS, IPS or Policy. These types are explained above.
2. Signature Group Category
This second level of naming describes the type of application or protocol. Examples are:
• BACKUP
• DB
• DNS
• FTP
• HTTP
3. Signature Group Sub-Category
The third level of naming further specifies the target of the group and often specifies the application
eg. MSSQL. The Sub-Category may not be necessary if the Type and Category are sufficient to spe-
cify the group eg. APP_ITUNES.
Listing of IDP Groups
A listing of IDP groupings can be found in Appendix B, IDP Signature Groups. The listing shows
groups names consisting of the Category followed by the Sub-Category since the Type could be any
of IDS, IPS or POLICY.
Processing multiple actions
For any IDP rule, it is possible to specify multiple actions and an action type such as Protect can be
repeated. Each action will then have one or more signatures or groups associated with it. When sig-
nature matching occurs it is done in a top-down fashion, with matching for the signatures for the
first action specified being done first.
IDP signature wildcarding
When selecting IDP signature groups, it is possible to use wildcarding to select more than one
group. The"?" character can be used to wildcard for a single character in a group name. Alternat-
ively, the "*" character can be used to wildcard for any set of characters of any length in a group
name.
Caution against using too many IDP signatures
Do not use the entire signature database and avoid using signatures and signature
groups unecessarily. Instead, use only those signatures or groups applicable to the
type of traffic you are trying to protect. For instance, using IDS_WEB*, IPS_WEB*,
IDS_HTTP* and IPS_HTTP* IDP groups would be appropriate for protecting an HT-
TP server.
IDP traffic scanning creates an additional load on the hardware that in most cases
shouldn't noticebly degrade performance. Using too many signatures during scanning
can make the load on the firewall hardware unecessarily high, adversely effecting
throughput.
130
Chapter 6. Security Mechanisms