topic Re: Good link to sig definitions needed. in Network Security

Good link to sig definitions needed.

randyclark — Sun, 10 Mar 2019 10:03:01 GMT

Does anyone know a good link to sig definitions for the Cisco IPS that does what each one does?

Re: Good link to sig definitions needed.

jlimbo — Wed, 07 Jun 2006 09:48:10 GMT

The MYSDN site has the signatures and their associated descriptions. Please refer to the link below:

http://tools.cisco.com/MySDN/Intelligence/home.x

I hope that helps.

Jonathan

Re: Good link to sig definitions needed.

kotek — Tue, 13 Jun 2006 13:36:05 GMT

I wonder if these descriptions are the same

that comes with IDM sig updates (.zip)

Re: Good link to sig definitions needed.

mhellman — Tue, 13 Jun 2006 14:04:57 GMT

No, they are not always in sync. See sig id 3030.

Re: Good link to sig definitions needed.

wsulym — Tue, 13 Jun 2006 16:20:21 GMT

The signature descriptions & benign triggers section are the same.

I just checked 3030 as was mentioned and I see the same description and benign triggers on MySDN, IEV, and in the NSDB.tar file packaged with the MC updates. Where are you seeing a difference?

Re: Good link to sig definitions needed.

mhellman — Tue, 13 Jun 2006 19:19:53 GMT

At one time I believe they were not. The description for 3030 was updated on MySDN. It was probably eventually also updated with an update to IEV or IDS MC....I just hadn't updated yet. It looks like there is different information in both (neither seems to be a mere subset of the other). Which makes me wonder, is there some process by which one is derived from the other so that they stay in sync?

Re: Good link to sig definitions needed.

wsulym — Thu, 15 Jun 2006 03:26:07 GMT

There are 2 distinct sources, signature descriptions and vulnerability records.The NSDB is built from each at each release. What you see on MySDN is a more interactive version of the NSDB plus more vulnerability information. But in either case, the source of the information is the same and so should be in sync. However, it's possible that there are a few signatures out of sync - could have happened in some moving around of databases in the not too distant past... that's probably what you remember regarding the 3030 sig information... Anyway, I'm trying to not get stuck on details here... in the end, there are two distinct sources we use and the NSDB is built fresh at each release, we can't really rebuild MySDN at each release. There really shouldn't be any discrepancies in data *since* MySDN was brought up, but it's possible that something happened just prior to that and we may have data out of sync.

If you see a discrepancy, by all means please bring it to our attention, and we'll fix it.

I hope I didn;t just confuse the issue more with this post.