IPS Signature updates

[networker99]

Is there a Cisco best practice for downloading IPS signature updates?, any documentation on this?, also how often are updates released?

[rjaaouan]

Hi,

to know all new Signature update, you can subsribe a ips-news@cisco.com distr list. You will revieve an email with all new Signature...

they will send you an email as soon as an update is availble, lik ethis:

1. Announcing the S387 Signature Update for IPS

The S387 signature update contains the following new signatures:

PLATFORM SIGID SIGNAME ENGINE SEVERITY ENABLED

5.x,6.x 6147.0 RealPlayer RealMedia Security Bypass string-tcp high false

5.x,6.x 6733.0 CA BrightStor ARCServe Backup LGServer Arbitrary File Upload string-tcp high false

5.x,6.x 6297.0 RealPlayer ActiveX Import Method Buffer Overflow meta high true

till now you need to download the signature on your compter, the upload it, or use an Autoupdate feature with the IDM.

I think Signatures are released, when there is new attack or weakness..., but you can use Anomaly Detection to detect any suspected behavior: Zero-Day detection.

Cheers

Reda

[rjaaouan]

Take a look also to this discussion:

http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Intrusion%20Prevention%20Systems/IDS&topicID=.ee6e1fc&fromOutline=&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cd25dcc