Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

Create and deploy a custom ids signature

I know how to write a snort signature, and it's very easy to deploy that signature. But I am not sure if I can do the same thing to cisco ids, I means easy customizing signature, and quick signature deployment.

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: Create and deploy a custom ids signature

The easiest scenario is to use the new Custom Signature Wizard in the latest 4.1 versions of the sensor:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids10/idmiev/swchap3.htm#31623

If you are using IDS MC for configuration, then I recommend using the Signature Wizard to create the signature on one sensor, then using the created fields you can add that signature into IDS MC for deployment onto multiple sensors.

http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cw2000/cw2000_b/vpnman/vms_2_1/idsmc11/ug/ch05.htm#520329

Step 5 for adding signatures

3 REPLIES
Silver

Re: Create and deploy a custom ids signature

You can create string based signiture.

"sensor signiture menu"-------> " active signiture template"---------> " signitures menu"------------->"String signiture menu"

----->'Add strign name or number"-------> Specify a port and "To or From" depending on requirement.

------>Enabel and IP LOg or Block.

Community Member

Re: Create and deploy a custom ids signature

Where did you perform the steps, ciscoworks?

Cisco Employee

Re: Create and deploy a custom ids signature

The easiest scenario is to use the new Custom Signature Wizard in the latest 4.1 versions of the sensor:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids10/idmiev/swchap3.htm#31623

If you are using IDS MC for configuration, then I recommend using the Signature Wizard to create the signature on one sensor, then using the created fields you can add that signature into IDS MC for deployment onto multiple sensors.

http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cw2000/cw2000_b/vpnman/vms_2_1/idsmc11/ug/ch05.htm#520329

Step 5 for adding signatures

201
Views
0
Helpful
3
Replies
CreatePlease to create content