topic Re: signature triggering in Network Security

signature triggering

mai2mai2m — Sun, 10 Mar 2019 10:54:35 GMT

If the conditions match two signatures, do they both get triggered or only the first one?

Thanks

Re: signature triggering

ccbootcamp — Sat, 15 Dec 2007 10:10:46 GMT

Yes, they both get triggered.

-brad

www.ccbootcamp.com

(please rate the post if this helps!)

Re: signature triggering

mai2mai2m — Mon, 17 Dec 2007 13:08:28 GMT

In CISCO IPS, can we wrtie a 'pass' rule to ignore good traffic and prevent it from trigger other signatures that cannot be turned off?

Thanks

Re: signature triggering

mhellman — Mon, 17 Dec 2007 14:53:47 GMT

you should be able to use an event action filter for this purpose. You can create a filter and put it at the top and set it to "stop on match". You can match on signature, ip address, port, and risk.

Re: signature triggering

mai2mai2m — Mon, 17 Dec 2007 19:20:49 GMT

Thanks for your responding.

Yes, looks like the CISCO wizard only allows to filter based on signature ID, ip, port, and risk. Is it poosible to filter on other fields in the header or payload?

Re: signature triggering

mai2mai2m — Mon, 17 Dec 2007 19:24:33 GMT

Thanks Brad. Regarding the "both triggered", would there be any CISCO document I can refer to?

Re: signature triggering

mhellman — Mon, 17 Dec 2007 19:31:35 GMT

You can only filter on those things. You can however create a custom signature that matches on something in the payload and then create a filter that subtracts all actions and has a "stop on match". If the signature matches every packet, then this should work quite well (we do it in fact). If the signature matches only one packet of many [in a stream you want to guarantee no alarms for] I'm not sure that it will work.

Re: signature triggering

ccbootcamp — Mon, 17 Dec 2007 19:34:10 GMT

Also, don't forget, when you do the custom event and enable "stop on match" you also MUST SELECT the actions you do NOT want to happen! A lot of people miss that step.

-brad

www.ccbootcamp.com

(please rate the post if this helps!)

Re: signature triggering

scothrel — Tue, 18 Dec 2007 15:59:30 GMT

I'll confirm Brad's post. We will trigger all alerts whose conditions are met by a packet or stream. We do not "fire first and forget"...that is a recipe for evasion.

You should be aware that in a stream signature, what has come before affects what happens in the present. We are analyzing the "stream"...not just the "packet". I mention this so that you can be aware that just because a particular condition exists in a packet, a signature may not fire because of something that was present (or not present) in a previous packet.

Scott C.