topic Re: Sig ID 50000 in Network Security

Sig ID 50000

lcuchisanmillan — Sun, 10 Mar 2019 10:24:43 GMT

I am working with CISCO ASA 5540 with AIP Module, and i see a lot of events from signature 50000 "Outbreak Prevention Signature" with high severity.

Could anyone explain this signature? What does it mean? Is it useful to be enable or not?

Regards,

Cristina

Re: Sig ID 50000

m.sir — Tue, 09 Jan 2007 12:48:01 GMT

Check following signature description

http://tools.cisco.com/MySDN/Intelligence/viewSignature.x?signatureId=50000&signatureSubId=0

This signature supports the Cisco Incident Control System (ICS) service.It you are not running Cisco ICS, this signature can safely be ignored.

Hope that helps rate if it does

Re: Sig ID 50000

jlively — Tue, 09 Jan 2007 14:49:44 GMT

That signature should be off by default. The only time it would be turned on would be during an outbreak. It would only remain on until a more specific signature could be deployed. At that point it would be turned back off.

What version are you running ?

Re: Sig ID 50000

lcuchisanmillan — Tue, 09 Jan 2007 16:36:27 GMT

IPS 5.1(4) S260

Re: Sig ID 50000

marcabal — Tue, 09 Jan 2007 19:51:55 GMT

Leave that signature/subsignatures Disabled.

By default they will trigger on all icmp,tcp, and udp packets.

Cisco ICS will first configure the signature to match only specific types of traffic and then Enable the signature.

Without Cisco ICS that signature is just Noise. It requires that special tuning by Cisco ICS.

So Disable that signature and just Ignore any old alerts from it if you do do not have Cisco ICS.