topic Simple signatures question!!! in Network Security https://community.cisco.com/t5/network-security/simple-signatures-question/m-p/1104293#M78013 <P>Hi Cisco team,</P><P></P><P>I have a simple question to do for you. Why most signatures per default is disable? Have any explanation? Why are obsoletes? What signature I should enable and what signature I should disable?</P><P></P><P>You could help me, please?</P><P></P><P></P><P>regards,</P><P></P><P>Rodrigo Alves</P> Sun, 10 Mar 2019 11:26:32 GMT rodrigo.cisco 2019-03-10T11:26:32Z Simple signatures question!!! https://community.cisco.com/t5/network-security/simple-signatures-question/m-p/1104293#M78013 <P>Hi Cisco team,</P><P></P><P>I have a simple question to do for you. Why most signatures per default is disable? Have any explanation? Why are obsoletes? What signature I should enable and what signature I should disable?</P><P></P><P>You could help me, please?</P><P></P><P></P><P>regards,</P><P></P><P>Rodrigo Alves</P> Sun, 10 Mar 2019 11:26:32 GMT https://community.cisco.com/t5/network-security/simple-signatures-question/m-p/1104293#M78013 rodrigo.cisco 2019-03-10T11:26:32Z Re: Simple signatures question!!! https://community.cisco.com/t5/network-security/simple-signatures-question/m-p/1104294#M78014 <HTML><HEAD></HEAD><BODY><P>My thoughts in no order.</P><P></P><P>signatures set to disable by default</P><P>a. Some signatures are for vulnerabilities that are very old. The signatures would only be needed in rare instances. Setting the signature to default can save the IPS resources.</P><P></P><P>b. The quality of a signature may not be very high. If the signature is enabled, a lot of false positives might be generated thus creating frustration for the admin.</P><P></P><P>I could continue but I think you get the idea.</P><P></P><P>Which signatures should be enabled?</P><P></P><P>The signatures that meet your environmental needs should be enabled. If you are an all Windows shop, you don't need Unix oriented signatures. In addition, you should enable signatures that match your organizations security policies.</P><P></P><P>I would start with the signatures Cisco has enabled by default. As you feel comfortable the alerts, tune false positives and correct problems, enable more signatures.</P></BODY></HTML> Wed, 31 Dec 2008 17:22:52 GMT https://community.cisco.com/t5/network-security/simple-signatures-question/m-p/1104294#M78014 rmeans 2008-12-31T17:22:52Z Re: Simple signatures question!!! https://community.cisco.com/t5/network-security/simple-signatures-question/m-p/1104295#M78015 <HTML><HEAD></HEAD><BODY><P>Tks a lot for you answer!!! Help so much.</P></BODY></HTML> Fri, 09 Jan 2009 03:30:28 GMT https://community.cisco.com/t5/network-security/simple-signatures-question/m-p/1104295#M78015 rodrigo.cisco 2009-01-09T03:30:28Z