I have tested this in the lab and you are correct that CSPM is not able to Exclude the 113 subsignature for signature 3000, and the exlcusion for all subsigs does not work for Simple
Filtering.
At this point you will have to either wait for a fix in CSPM or manually add the following configuration line to the bottom of packetd.conf yourself (Note: this has to be manually added
every time CSPM pushes a new configuration to the sensor)
RecordOfExcludedPattern 3000 113 * aaa.bbb.ccc.ddd
I have created the following 2 DDTS Issues:
CSCdu45962: CSPM 2.3i can not filter user added TCP and UDP connection sigs
-------------------------------------------------------------
Symptom:
User attempts to filter certain addresses for a TCP or UDP port connection
signature which the user added. The port, however, does not appear in
the list of subsignatures which can be excluded.
Condition:
The CSPM configuration GUI will generate a list of TCP ports when the
user selects to filter the 3000 TCP Connection signature. (Problem
also exists for the 4000 UDP connection signature.)
The list generated, however, is not based on the signature template
applied to the sensor. The user has the ability to add new TCP ports
and UDP ports to the list of connection signatures. These new
ports (sub signatures) should be in the list of SubSignatures when the
3000 (or 4000) signature is selected in the Filtering or Advanced Filtering
tabs.
To replicate:
1) Open the Default Signature template (or another template)
2) Click on the Connection Signatures tab
3) Add a new connection signature for TCP port 113 and name it
Connection request- ident/auth
4) Click OK to save the changes
5) Click on the sensor
6) Click on the Filtering Tab
7) Click to Add a new filter
8) Select the 3000 signature
9) The Connection request- ident/auth should show up as a SubSignature
if the GUI was working correctly, instead ONLY the default sub signatures
are listed.
CSCdu46008: CSPM 2.3i - simple filtering - all sibsignatures should be 0 subsig
Symptom:
User attempts to use the Simple Filtering (on the Filtering Tab) to
exclude "All SubSignatures" for a signature that has multiple subsignatures
(the 3000 signature for example.
The sensor continues to fire the signature even after the configuration
is applied.
Condition:
The user selects the Filtering Tab and clicks Add to create a new
Simple Filter.
The user selects the signature and then selects "All SubSignatures".
The resulting line in packetd.conf on the sensor has:
RecordOfExcludedNetAddress [signature] * [address] [netmask] [1|2|3]
The "*" in the second field should be a zero "0" instead of "*", and the
selection should have said "0 SubSignature" instead of "All SubSignatures"
The RecordOfExcludedNetAddress with a "*" wildcarding the subsignature
is not understood by the sensor.
WorkAround:
Instead of using the Simple Filtering the user should upgrade to the
latest signature update available, and then user Advanced Filtering to
exclude the signature.
The Advanced Filtering tab uses the RecordOfExcludedPattern configuration
token instead of the RecordOfExcludedNetAddress token.
The later sensor versions do understand the RecordOfExcludedPattern
token with the "*" used to wildcard for All SubSignatures.
Steps:
Highlight the Simple Filter and Delete it.
Click on the Advanced Filter tab.
Click Add to add a new Advanced Filter.
Select the desired signature.
Select the "All SubSignatures" option
Select the source and destination address parameters.
The resulting line in packetd.conf will look like:
RecordofExcludedPattern [signature] * [sourceaddresses] [destinationaddresses]
