×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

Configuration of IDS and CSPM 2.3.3I

Unanswered Question
May 3rd, 2002
User Badges:

I keep reading the NetPro postings and see that you can "tweak" signatures to be less sensitive or more sensitive. I have the CSPM database reporting signatures. Now, I would like to be able to tweak them or create new signatures based on my own knowledge. Is there a document out there that will show me how to do this? Also, is there a website out there with the latest strings that can be installed as an interim until the new signature update comes out?


Thanks

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
ciscomoderator Thu, 05/09/2002 - 14:15
User Badges:
  • Gold, 750 points or more

Often times advanced configuration issues are best addressed in an interactive session with one of our trained technical assistance engineers. While other forum users may be able to help, it’s often difficult to do so for this type of issue.


To utilize the resources at our Technical Assistance Center, please visit http://www.cisco.com/tac and to open a case with one of our TAC engineers, visit http://www.cisco.com/tac/caseopen


If anyone else in the forum has some advice, please reply to this thread.

Thank you for posting.


marcabal Thu, 05/09/2002 - 14:36
User Badges:
  • Cisco Employee,

Refer to the following two links for how to tweak signatures and create new signatures (NOTE: Only supported on appliances):

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids6/12216_02.htm#xtocid1115818

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids6/13346_01.htm


When 3.1 is released the IDM (web based Intrusion Detection Device Manager) can also be used to tweak the signatures and create new ones.


As for a website showing the latest strings. There is not one. We release the signatures on a 2 week cycle for the appliance. We don't release the strings for these signatures prior to that because they are being constantly tweaked up until the release of the signature. In cases where a real bad attack has just been released, we will execute an emergency signature update that same day if possible. (The IDS Management Team determines if the attack is "bad" enough to require us to spend the extra effort to produce an emergency signature update.)


However, users are encouraged to generate their own custom signature updates. Some users have begun posting those custom signatures on this Net Pro Posting and would encourage you to do the same when you come up with some.


Actions

This Discussion