How does one modify signatures 6505 and 6506 to shun?

[chrisv]

I looked for these signatures to make modifications but I could not find them.

Thank you,

Chris

[s.jankowski]

Read through the following document:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/0866_02.htm

[marcabal]

I assume you mean you can't find them in CSPM.

If you mean in another management tool then let me know which one.

If so then if these sigs were added in a signature update, they may not be in numerical order.

When the signature update ocurrs it adds the new sigs to the bottom of the list. So start at the very bottom of the list and work your way all the way back up to the top.

The Signature IDS may look in numerical order but you may find that they are not.

Also ensure that you are selecting to view ALL signatures instead of a specific version of signatures.

NOTE:

I don't remember for sure, but you might try selecting the Signature ID number header to get the tables sorted by Signature ID. I know it works in some windows, but I am not sure if it works in that window.

[chrisv]

Thank you! I did find it in CSPM.

However, I did not in the web management interface of the IDS sensor.

Thank you,

Chris

[marcabal]

In IDM all of the Sigs are listed in:

Configuration->Sensing Engine->Signature Configuration->Signature Groups->All Signatures

On Page 34 (Note page number may change depending on signature update.)

You can change the page in the lower right hand of the screen by selecting the page number and selecting "Go to page".