Please explain this rule how it works. Is it detecting the alert based only on the content "R|00|23". Please explain how to figure this out. IPS Rule: alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-BACKDOOR wow 23 runtime detection...
Network Security
Engage with peers and experts on network security topics such as FTD, FMC, FDM, CDO and ASA.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- Technology and Support
- Security
- Network Security
Options
- Mark all as New
- Mark all as Read
- Float this item to the top
- Subscribe
- Bookmark
- Subscribe to RSS Feed
- Threaded format
- Linear Format
- Sort by Topic Start Date
Labels
-
AAA
(9) -
Access Control Server (ACS)
(6) -
Access List
(4) -
ACI
(10) -
Advanced Threats
(1) -
AMP for Endpoints
(1) -
AnyConnect
(3) -
APIs
(1) -
Appliances
(18) -
ASA
(1) -
ASR 1000 Series
(1) -
Branch Router
(2) -
Buying Recommendation
(83) -
Catalyst 2000
(1) -
Catalyst 3000
(2) -
Catalyst 4000
(1) -
Catalyst 6000
(1) -
Catalyst 8000
(1) -
Catalyst 9000
(2) -
Catalyst Switch
(2) -
Catalyst Wireless Controllers
(1) -
Cisco
(1) -
Cisco Adaptive Security Appliance (ASA)
(9,490) -
Cisco Bugs
(22) -
Cisco Cafe
(25) -
Cisco CLI Analyzer
(1) -
Cisco Cloud Services Router
(1) -
Cisco Defense Orchestrator (CDO)
(133) -
Cisco Firepower Device Manager (FDM)
(794) -
Cisco Firepower Management Center (FMC)
(2,871) -
Cisco Firepower Threat Defense (FTD)
(3,110) -
Cisco Press Cafe
(1) -
Cisco Security Manager (CSM)
(3) -
Cisco Software
(18) -
CISCO START ANZ
(1) -
Cisco Threat Response
(1) -
Cisco Vulnerability Management
(40) -
Cloud
(1) -
Cloud Security
(3) -
Community Bug or Issue
(1) -
Community Feedback Forum
(31) -
Community Ideas
(18) -
Compliance and Posture
(1) -
Crypto
(1) -
CSC Content with No Valid Community to Post
(1) -
CUBE
(1) -
CUCM
(1) -
Data Center Networking
(1) -
Device Admin
(13) -
EEM Scripting
(1) -
Emergency Responder
(1) -
Endpoint Security
(6) -
Enterprise Agreement
(1) -
Event Analysis
(255) -
FirePOWER
(1) -
Firepower Chassis Manager (FCM)
(2) -
Firepower Device Manager (FDM)
(16) -
Firepower Management Center (FMC)
(408) -
Firepower Threat Defense (FTD)
(221) -
Firewall Migration Tool (FMT)
(21) -
Firewalls
(1,171) -
FMC
(1) -
General
(2) -
Guest
(1) -
Identity Services Engine (ISE)
(9) -
IE3300
(1) -
Integrated Security
(8) -
Integrated Security Architecture
(1) -
Integrations
(3) -
Investigation
(2) -
iOS
(1) -
IPS and IDS
(6,564) -
IPS and IDS1
(1) -
IPS-IDS
(1) -
IPSEC
(1) -
ISE
(1) -
LAN Switching
(7) -
License
(315) -
MPLS
(1) -
Multicloud Defense
(1) -
Network Management
(89) -
Network Security
(2) -
Networking
(1) -
NFVIS
(1) -
NGFW Firewalls
(37,546) -
NGIPS
(1,872) -
Online Tools and Resources
(1) -
Open Source and Open Standards
(1) -
Optical Networking
(3) -
Optics
(1) -
Other Automation Analytics Topics
(1) -
Other Collaboration Topics
(1) -
Other Community Feedback
(5) -
Other Firewalls
(1) -
Other IP Telephony
(1) -
Other NAC
(18) -
Other Network
(1) -
Other Network Security Topics
(10,757) -
Other Networking
(8) -
Other Routers
(9) -
Other Routing
(23) -
Other Routing and Switching topics
(2) -
Other Security
(1) -
Other Security Topics
(18) -
Other Switches
(11) -
Other Switching
(4) -
Other VPN Topics
(1) -
Passive Identity
(1) -
Physical Security
(20) -
Policy and Access
(2) -
Prioritization
(2) -
Remote Access
(2) -
Room Endpoints
(1) -
Routing Protocols
(7) -
SD-WAN Security
(1) -
Secure Network Analytics
(1) -
Security
(2) -
Security Management
(618) -
Segmentation
(3) -
Service Providers
(1) -
Small Business Routers
(4) -
Small Business Security
(2) -
Sourcefire
(2) -
Support
(2) -
Threat Containment
(5) -
Threat Defense
(1) -
Unified Computing System (UCS)
(1) -
Voice Gateways
(1) -
VPN
(25) -
VPN and AnyConnect
(1) -
Vulnerability Management
(40) -
WAN
(7) -
Web Security
(5) -
Webex Teams
(1) -
Wired
(3) -
Wireless Security
(1)
- « Previous
- Next »
Forum Posts
IPS RULE: alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (sid:1000122; gid:1; flow:established,to_server; content:"SSH-"; depth:4; detection_filter:track by_src, count 30, seconds 60; msg:"Local - BAD-TRAFFIC SSH brute force login attempt"; classtype:Hi...
Resolved! syslog server in sourcefire/firepower
How to configure syslog server in sourcefire/firepower?
Resolved! Ramsomware blocking signature
Dears, i have a sourcefire in my network and i want to block ramsomware attacks what shild i do for that ????? i have read on cisco sites Cisco has release a snort rules. what are these snort rules ??? https://tools.cisco.com/security/center/content...
Disclaimer: This is the first ASA I've ever had to setup. Very new to this, but I was volun-told to set this up. Spent 3 days now and just need some expert advice/direction to go. Issue: I cannot seem to get internet access to any device connected t...
My question is that how should we do the cabling on FirePower hardware module for data traffic coming in and going out from FirePower module.In a software module, we create security zones as per the ASA interface as an inside interface on ASA will be...
Resolved! Cisco License
I have an Cisco ASA 5515 i have already installec cisco any conect license for 100. but i wan't it to but 250 more, the question is do i need to added on other asa these 250 or can i build on same platform to be 350 ??I have an ASA with 100 license ...
HI all, We have pair of Firepower 4120, and need to configure the active/ standby HA for ASA, Do we have to create first cluster for the Firepower and then add logical device as ASA right ? Can i get good document to configure this ? Please assist
Resolved! Cisco ASA Failover
Good morning all, we are seeing some funny behavior with our ASA's. Its a 5545 and we have numerous static NAT rules setup. the issue seems to be that when the ASA fails over the internal hosts that have the static NAT rules enabled for lose connect...
Resolved! ASA FirePower .img VS .pkg
hi, i'm in the process of upgrading our asa 5525-X with FP module and saw the link below. https://supportforums.cisco.com/blog/12294976/asa-5500-x-sourcefire-firepower-configuration sorry for being a noob, but i would like some clarification and need...
Hi all, I have an ISA3000 running 9.7.1. I have four different route based VPN connection back to some PA3020's. These are up and working great. Traffic is successful in transiting the VPNs, however, I am having issues getting ICMP to a inside int...
Resolved! Issue with Policy Based Routing
I'm trying to set up policy based routing in a staging environment. The ASA is a 5515-x running 9.44 and it supports it. I have one internal interface and two external interfaces (ISP1 and ISP2) ISP1 is the default route. I'm trying to route tra...
Resolved! ASA 5515 second outside interface
Good day all, can someone advise what is the best way to go about setting up a second outside interface on ASA - reason behind is that we're trying to have a security alarm system have a dedicated internet feed, having 2 disabled interface on our ASA...
I have a ticket open about this issue, but I am hoping to find an answer on here faster.. My LDAP/realm is configured properly, I can see who is logged into a specific host yet group filtering doesn't seem to be working.. In the summary charts, und...
hi i have two subnet at one end. 10.30.X.X for the lan and 10.13.2.X for the wireless which i have created site to site vpn tunnel to a different site with lan 192.168.30.X and wireless 192.168.31.X. now the problem what i am facing is that when i ...
Learn, share, save
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide
Unanswered Topics
| Subject | Author | Posted |
|---|---|---|
| 06-02-2025 12:29 AM | ||
| 05-29-2025 01:35 PM | ||
| 05-22-2025 06:07 PM | ||
| 05-21-2025 04:13 AM | ||
| 05-19-2025 07:01 AM |
New solutions
Top Solution Authors
| User | Count |
|---|---|
| 5 | |
| 4 | |
| 2 | |
| 2 | |
| 2 |
