IDS device signature import - some help

[interover]

Hi there,

Has anyone ever imported a signature set in an IDS device?

So you can export signatures to a CSV, but can you import them back in this way? If not, when you create an ‘export file’ in CSM, can you merge that .cfg to the IDS and only affect the signature set?

I am asking in order to do some deployments to multiple IDS sensors when CSM isn’t function / cant be used to deploy, but only to generate config file.

Thanks guys!

[rhermes]

CSM has the concept of Signature Policies that do what you want.

Take your reference sensor that has the signatures tuned the way you want and "share" that signature policy.

Once shared your can apply this policy to as many other sensors you like. (don't forget to submit and deploy your changes)

The CSV export is only for makeing spreadsheet or reports of your signature settings/policy.

If you don;t have CSM you can spill the config of a sensor (show conf) and paste the signature configurations into another sensor via the command line.

- Bob