Chapter 7. Advanced Signature Configuration

This chapter covers the following subjects:

• Advanced Signature Configuration

• Meta-Event Generator

• Understanding HTTP and FTP Application Policy Enforcement

• Tuning an Existing Signature

• Creating a Custom Signature

Many Cisco IPS deployments can take advantage of default signature configurations. Sometimes, however, you may need to create a custom signature or tune an existing signature to meet the needs your specific network environment. Cisco IPS provides the capability to tweak existing signatures and to easily create custom signatures based on the various Cisco IPS signature engines.

When default signature configurations do not match your requirements, you can either tune existing signatures to match your requirements or create your own custom signatures. Understanding the various signature fields is vital to your successful completion of either of these operations.

"Do I Know This Already?" Quiz

The purpose of the "Do I Know This Already?" quiz is to help you decide if you really need to read the entire chapter. If you already intend to read the entire chapter, you do not necessarily need to answer these questions now.

The 10-question quiz, derived from the major sections in the "Foundation and Supplemental Topics" portion of the chapter, helps you determine how to spend your limited study time.

Table 7-1 outlines the major topics discussed in this chapter and the "Do I Know This Already?" quiz questions that correspond to those topics.

Table 7-1. "Do I Know This Already?" Foundation and Supplemental Topics Mapping

Foundation or Supplemental Topic	Questions Covering This Topic
Advanced Signature Configuration Regular Expressions String Matching	9
Advanced Signature Configuration Signature Fields	1, 2
Meta-Event Generator	3, 7
Understanding HTTP and FTP Application Policy Enforcement	8, 10
Tuning an Existing Signature	4, 5
Creating a Custom Signature	6

Caution

The goal of self-assessment is to gauge your mastery of the topics in this chapter. If you do not know the answer to a question or are only partially sure of the answer, you should mark this question wrong for purposes of the self-assessment. Giving yourself credit for an answer you correctly guess skews your self-assessment results and might provide you with a false sense of security.

1.	Which signature field indicates the likelihood that the signature will trigger on attack traffic? Alert Severity Signature Fidelity Rating Target Value Rating Event Action Override Alert Notes
2.	Which of the following is not a valid value for the Event Count Key field? Attacker address Victim address Attacker and victim addresses Attacker address and port Attacker address and victim port
3.	To create a signature that generates an alert based on multiple component signatures, which of the following signature engines should you use? AIC HTTP Meta Normalizer Multi String Service General
4.	Which of the following is considered tuning a signature? Enabling a signature Disabling a signature Changing the Alert Severity level Changing the signature's engine-specific parameters Assigning a new signature action
5.	Which of the following is not considered tuning a signature? Changing the signature's engine-specific parameters Changing the signature's event counter parameters Assigning a new severity level Changing the signature's alert frequency parameters
6.	What is the first step in creating a custom signature? Choose a signature engine. Define event counter parameters. Test signature effectiveness. Define alert frequency parameters. Define basic signature fields.
7.	Which of the following is true about meta signatures? The meta signature can use only component signatures from the same signature engine. The order of the component signatures can be specified. The order of the component signatures cannot be specified. You can configure a reset interval for each component signature.
8.	For which protocol is application policy enforcement supported in Cisco IPS version 5.0? SMTP NTP HTTP ARP IP
9.	Which regex will match one or more As? [^A]* [A]+ [A]? [A]* [^A]+
10.	Which signature engine enables you to detect tunneling of non-HTTP traffic through port 80? Service HTTP Service FTP AIC HTTP AIC FTP Service Generic

The answers to the "Do I Know This Already?" quiz are found in the appendix. The suggested choices for your next step are as follows:

• 8 or less overall score Read the entire chapter, including the "Foundation and Supplemental Topics," "Foundation Summary," and Q&A sections.

• 9 or 10 overall score If you want more review on these topics, skip to the "Foundation Summary" section and then go to the Q&A section. Otherwise, move to the next chapter.