Signature for web scanning

[alkabeer80]

Hi, i have webserver and i want to block scan for website using IPS ( any type of scan which reveals server infomoration).

Is there any signature used, if not can i create custom signature (how i can do it)

thankssssssssssss                  

[_____Adam]

The only generic signature I see that is available here is 5724.0 which detects the Nikto scanner.

Many of these web scanners use specific techniques that we will block in generic web vulnerability signatures but they are not called out specifically as blocking a scanner.

For example you can try enabling the 5930 signatures for SQL injection protection.

If you want to create a custom signature, please follow this guide:

http://www.cisco.com/web/about/security/intelligence/ips_custom_sigs.html