No Shunning on Sig 5343 or 5348

[rrussell]

In S37 there are 2 signatures that do not allow for blocking. As a matter of fact they allow for no actions to be taken on the signature at all.

I am administring the appliance sensors via the web interface. Has anyone else experienced this issue or is it a "feature" of those particular signatures?

[mcerha]

There is nothing that should be precluding you from blocking with these signatures. Are you getting an error message of some kind from IDM?

[rrussell]

Negative. There are just 5 fields displayed when I go into edit that signature.

ID - 5343

Signature - Apache Host Header...

Severity - High (this field is editable)

Action - None

Comments - Apache Host ... (this field is editable)

This is a far cry from the usual fields I get when editing a signature. Should I open a TAC case?

[stleary]

If the Action field is set to None and is not editable, then either there

are no legal actions possible, or the legal actions were

accidentally left out. It looks like this might be the latter case.

Investigating...

[mcerha]

We did indeed have a problem with the S37 signature update package. We will have an S38 package out by the end of this week (Friday), so we won't update S37. I'll post here with a location to the S38 files when they are available. We apologize for any incovenience.

[rrussell]

Excellent. I appreciate your quick responses and await the new signature update with anticipation.

Ron Russell

Calence Inc

[rrussell]

It's past the date you indicated, and there is still no S38. Do you have a new ETA?