How to add a filter to signiture?

cbergel · ‎09-17-2003

A specific host allways attack to our network.This host is using DNS Server.We don't want this to be detected as an attack.How to add a filter to this signiture?

signiture id 4003 "Nmap UDP Port Sweep"

shawn.posthumus · ‎09-18-2003

Heres one way:

log into your sensor via ssh

sensor#conf t

sensor#service alarm-channel-configuration virtualAlarm

sensor#tune-alarm-channel

sensor#EventFilter

sensor#Filters DestAddrs Exception False SIGID 4003 SourceAddrs SubSig *

sensor#exit

save changes when prompted.

cbergel · ‎09-18-2003

thank you very much.

garyprice · ‎09-18-2003

are you using a network IDS sensor. Like a Cisco-K9-4235? If so I can detail the very simple process to filter "out" the source from detection from the signature 4003