topic Address parameters in the signature definitions (4.1) in Network Security

Address parameters in the signature definitions (4.1)

k.lapczuk — Sun, 10 Mar 2019 09:14:33 GMT

Is there any way to change the action triggered by the signature based upon the network/host source/destination address in all kinds of engines? In Atomic engine it is possible - for example triggering different levels of alarms, based upon the victim network address. What about the all other engines?

Re: Address parameters in the signature definitions (4.1)

marcabal — Mon, 24 Jan 2005 15:32:13 GMT

Question: Is there any way to change the action triggered by the signature based upon the network/host source/destination address in all kinds of engines?

Response: No. When the signature is defined the selected actions will take place regardless of the addresses (unless the alarm is filtered).

Question: In Atomic engine it is possible - for example triggering different levels of alarms, based upon the victim network address. What about the all other engines?

Answer: No In version 4.x the alarm is either triggered and the actions taken, or the alarm is filtered and no actions are taken.

SIDE NOTE:

Some of this changes in version 5.0.

You still won't be able to assign specific actions for a given address set. But combinations of some of the added features may come close to providing you the granularity you are asking for.

I would suggest posting this question again after 5.0 is released. Then I will be able to go into feature details and give you some hints and tricks to get close to what you are asking for.

Re: Address parameters in the signature definitions (4.1)

k.lapczuk — Tue, 25 Jan 2005 15:14:04 GMT

Thanks, that exactly (unfortunately) how I thought it works.