Configuration of IDS and CSPM 2.3.3I

[dpatkins]

I keep reading the NetPro postings and see that you can "tweak" signatures to be less sensitive or more sensitive. I have the CSPM database reporting signatures. Now, I would like to be able to tweak them or create new signatures based on my own knowledge. Is there a document out there that will show me how to do this? Also, is there a website out there with the latest strings that can be installed as an interim until the new signature update comes out?

Thanks

[ciscomoderator]

Often times advanced configuration issues are best addressed in an interactive session with one of our trained technical assistance engineers. While other forum users may be able to help, it’s often difficult to do so for this type of issue.

To utilize the resources at our Technical Assistance Center, please visit http://www.cisco.com/tac and to open a case with one of our TAC engineers, visit http://www.cisco.com/tac/caseopen

If anyone else in the forum has some advice, please reply to this thread.

Thank you for posting.

[marcabal]

Refer to the following two links for how to tweak signatures and create new signatures (NOTE: Only supported on appliances):

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids6/12216_02.htm#xtocid1115818

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids6/13346_01.htm

When 3.1 is released the IDM (web based Intrusion Detection Device Manager) can also be used to tweak the signatures and create new ones.

As for a website showing the latest strings. There is not one. We release the signatures on a 2 week cycle for the appliance. We don't release the strings for these signatures prior to that because they are being constantly tweaked up until the release of the signature. In cases where a real bad attack has just been released, we will execute an emergency signature update that same day if possible. (The IDS Management Team determines if the attack is "bad" enough to require us to spend the extra effort to produce an emergency signature update.)

However, users are encouraged to generate their own custom signature updates. Some users have begun posting those custom signatures on this Net Pro Posting and would encourage you to do the same when you come up with some.