Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

Simple signatures question!!!

Hi Cisco team,

I have a simple question to do for you. Why most signatures per default is disable? Have any explanation? Why are obsoletes? What signature I should enable and what signature I should disable?

You could help me, please?

regards,

Rodrigo Alves

1 ACCEPTED SOLUTION

Accepted Solutions
Community Member

Re: Simple signatures question!!!

My thoughts in no order.

signatures set to disable by default

a. Some signatures are for vulnerabilities that are very old. The signatures would only be needed in rare instances. Setting the signature to default can save the IPS resources.

b. The quality of a signature may not be very high. If the signature is enabled, a lot of false positives might be generated thus creating frustration for the admin.

I could continue but I think you get the idea.

Which signatures should be enabled?

The signatures that meet your environmental needs should be enabled. If you are an all Windows shop, you don't need Unix oriented signatures. In addition, you should enable signatures that match your organizations security policies.

I would start with the signatures Cisco has enabled by default. As you feel comfortable the alerts, tune false positives and correct problems, enable more signatures.

2 REPLIES
Community Member

Re: Simple signatures question!!!

My thoughts in no order.

signatures set to disable by default

a. Some signatures are for vulnerabilities that are very old. The signatures would only be needed in rare instances. Setting the signature to default can save the IPS resources.

b. The quality of a signature may not be very high. If the signature is enabled, a lot of false positives might be generated thus creating frustration for the admin.

I could continue but I think you get the idea.

Which signatures should be enabled?

The signatures that meet your environmental needs should be enabled. If you are an all Windows shop, you don't need Unix oriented signatures. In addition, you should enable signatures that match your organizations security policies.

I would start with the signatures Cisco has enabled by default. As you feel comfortable the alerts, tune false positives and correct problems, enable more signatures.

Community Member

Re: Simple signatures question!!!

Tks a lot for you answer!!! Help so much.

130
Views
0
Helpful
2
Replies
CreatePlease to create content