Extracting Signature Database from Appliance

[lbhoang]

With v5.1(3)the signatures are no longer displayed in command-line. Is there a way to extract a signature configuration list from the appliance in a readable format? Thank you in advance.

Btw, kudos to the Cisco IPS team. 5.1(3) is a big improvement over 4.1(x).

[jwalker]

One way to get the file is to create a service account. After creating the account, login to the service account using the CLI. Then type cd /usr/cids/idsRoot/etc/config/signatureDefinition/instances to change to the appropriate directory.. When in the right directory, ftp the sig0.xml file to another PC for viewing.

** Please rate if this helps***

[scothrel]

Can you define "readable"?

The ultimate description of the signatures is the file "default.xml" in /usr/cids/idsRoot/etc/config/signatureDefinition.

Log into a service account to get shell access to the file. DO NOT edit this file, it is the base file. The Delta file is sig0.xml in the "instances" subdir from the above location.

[marcabal · Accepted solution]

You can get it from the CLI by doing:

config t

service signature-definition sig0

show settings | include sig-id|subsig-id|sig-name

You can change the list of parameters to include in order to change what you want to see.

[lbhoang]

All good info but Marcoa's info is exactly what I'm looking to do to generate a list of signatures, subsigs, name, action and if enabled to another group or person in a readable format. This saved me from having to parse or convert XML. Thanks!

show settings | include sig-id|subsig-id|sig-name|event-action|enabled