• Advertisement

sa520 ips signatures -- definitions?

Linksys, Netgear, sonicwall, ect. Webbase configurations for firewalls. Web filting traffic shaping.

sa520 ips signatures -- definitions?

Postby Guest » Wed May 27, 2009 11:16 pm

  could anyone shed some light on what the signature discription available below are a subset are specifically - what does each check?

 

is there a decoder ring somewhere?

 

Signature IDSignature DescriptionDisabledDetect OnlyDetect and Prevent
      1000076      SBIPS2009-000076
      1000085      SBIPS2009-000085
      1000086      SBIPS2009-000086
      1000087      SBIPS2009-000087
      1000120      SBIPS2009-000120
      1000232      SBIPS2009-000232
      1000233      SBIPS2009-000233
      1000235      SBIPS2009-000235
      1000236      SBIPS2009-000236
      1000237      SBIPS2009-000237

Guest
 

Advertisement

Re:sa520 ips signatures -- definitions?

Postby Guest » Thu May 28, 2009 12:03 am

I will take a swipe at this since their bascially a light version of other Cisco IPS signatures.

 

Personally I take the easy Google search route, but you may be able to obtain an RSS feed to provide direct links.

 

Example: Google SBIPS2009-000076

 

Returns: http://tools.cisco.com/security/center/viewAlert.x?alertId=18181

 

As for the breakdown of the gory technical details, it will vary with each signature. I do know many agencies will allow the signatures to be on by default, but its all up to you. Troubleshooting a BAD IPS signature can be difficult, but I wouldn worry since a huge amount of testing goes into them.

 

Basically they are SNORT signatures... Shhh, Cisco does not want you to look under the open source hood and build your own firewall.

 

Does that help?

Guest
 

Re:sa520 ips signatures -- definitions?

Postby Guest » Thu May 28, 2009 12:36 am

Hi,

 

You can use the link below to check the Small Business IPS signature defnitions:

 

http://tools.cisco.com/security/center/viewIpsLiteSignature.x?signatureId=2010-000215

 

Just replace the signature ID with the one you are insterested.

 

 

Regards,

Wei

Guest
 



  • Advertisement


Similar topics

SA520 VOIP Ports
Forum: Small Business Security
Author: Guest
Replies: 0

SA520 Quick VPN Active Directory
Forum: Small Business Security
Author: Anonymous
Replies: 0

Cisco IPS Signatures list
Forum: Cisco Security
Author: Anonymous
Replies: 0

How to tune the signatures of AIP-SSM-20
Forum: Cisco Security
Author: Anonymous
Replies: 0

SA520
Forum: Small Business Security
Author: Anonymous
Replies: 0


Return to Small Business Security

Who is online

Users browsing this forum: No registered users and 2 guests