Chapter 5. Basic Cisco IPS Signature Configuration

This chapter covers the following subjects:

• Configuring Cisco IPS Signatures

• Signature Groups

• Alarm Summary Modes

• Basic Signature Configuration

The heart of the Cisco IPS is the signatures that the sensor uses to identify intrusive traffic on your network. Viewing signatures by using signature groups enables you to efficiently configure the numerous Cisco IPS signatures to match your unique network configuration.

Your Cisco IPS sensors check network traffic against signatures of known intrusive traffic. It is important to understand how to locate the signatures available as well as to determine which signatures are most important in your unique network environment. This chapter explains how you can use IPS Device Manager (IDM) to view the different signatures by signature group and to enable the numerous signatures that are available. Advanced signature configuration operations, such as signature tuning and creating custom signatures, will be covered in Chapter 7, "Advanced Signature Configuration."

"Do I Know This Already?" Quiz

The purpose of the "Do I Know This Already?" quiz is to help you decide if you really need to read the entire chapter. If you already intend to read the entire chapter, you do not necessarily need to answer these questions now.

The 10-question quiz, derived from the major sections in the "Foundation and Supplemental Topics" portion of the chapter, helps you determine how to spend your limited study time.

Table 5-1 outlines the major topics discussed in this chapter and the "Do I Know This Already?" quiz questions that correspond to those topics.

Table 5-1. "Do I Know This Already?" Foundation and Supplemental Topics Mapping

Foundation or Supplemental Topic	Questions Covering This Topic
Signature Groups	1, 2, 6
Alarm Summary Modes	3, 4, 5
Basic Signature Configuration	7, 8, 9, 10

Caution

The goal of self-assessment is to gauge your mastery of the topics in this chapter. If you do not know the answer to a question or are only partially sure of the answer, you should mark this question wrong for purposes of the self-assessment. Giving yourself credit for an answer you correctly guess skews your self-assessment results and might provide you with a false sense of security.

1.	Which of the following is not a valid IDM signature group? Attack Operating System Service Signature Release Policy Violation
2.	Which of the following is not a valid signature response option? Deny Victim Inline Deny Attacker Inline Produce Alert Request SNMP Trap Log Pair Packets
3.	Which of the following is not a valid summary key? Attacker address Attacker address and victim port Victim address and attacker port Attacker and victim addresses Attacker and victim addresses and ports
4.	Which of the following is not a valid alarm summary mode? Fire Once Summary Global Summary Fire All Fire Global
5.	Which parameter determines when alarm summary mode takes effect? Global Summary Threshold Summary Threshold Choke Threshold Throttle Interval None of these
6.	Which of the following is not a valid service signature group? DHCP General Service SOCKS ARP File Sharing
7.	Which of the following is not a field on the Network Security Database (NSDB) signature information page for version 5.0? Description Benign Trigger(s) Recommended Signature Filter Related Threats Related Vulnerabilities
8.	Which button activates a signature that has been disabled? Enable Activate Add No Disable None of these
9.	Which button activates a signature that has been retired? Enable Activate Restore Add You cannot retire signatures
10.	When you create a custom signature, which option starts with the settings for an existing signature? Add Duplicate Copy Clone Replicate

The answers to the "Do I Know This Already?" quiz are found in the appendix. The suggested choices for your next step are as follows:

• 8 or less overall score Read the entire chapter, including the "Foundation and Supplemental Topics," "Foundation Summary," and Q&A sections.

• 9 or 10 overall score If you want more review on these topics, skip to the "Foundation Summary" section and then go to the Q&Asection. Otherwise, move to the next chapter.