cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
741
Views
0
Helpful
1
Replies

Signatures - Reviewing Details & Creating new ones

davidculp
Level 1
Level 1

Does anyone know how to review the details of the

"canned" signatures ? Also any reference material and/or links for creating custom ones ?

Thanks,

David

1 Reply 1

marcabal
Cisco Employee
Cisco Employee

If you are using the CLI then enter the CLI commands to get you to the point where you would tune the sensor. Then enter the command "show settings".

It will show you the current settings as well as the default entries.

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids10/cmdref/15599ch2.htm#wp380148

The same can also be seen through IDM for each signature:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids10/idmiev/swchap3.htm#wp31460

For creating custom signatures the easiest way is to use the Signature Wizard in IDM:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids10/idmiev/swchap3.htm#wp31623

The signature wizard will generally work for over 90% of the types of custom signatures that users generally create.

For the remaining 10% that required advanced settings and parameters not handled by the wizard the user would need to reference the detailed descriptions of the engine parameters:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids10/idmiev/swappa.htm

(Most users dealing with these special types of sigs will post on the Forum are receive help from more experienced users and even signature developers).

Review Cisco Networking for a $25 gift card