Filter
Top Products
48
McAfee
®
Host Intrusion Prevention 6.1 Product Guide IPS Policies
IPS Rules policy details
4
To modify the view of signatures:
Right-click in the signature list and select the desired view:
Modifying host and network signatures
You can view and modify default signatures on the Signatures tab of the IPS Rules policy.
This enables you to change the severity level of the signature if the signature is causing
false positives.
To modify default signatures:
1 Double-click the signature you want to modify.
The
Signature Properties dialog box appears.
2 On the General tab, modify the Severity Level, Allow Client Exceptions, or Log Status
settings, and enter notes in the
Note box to document the change.
3 On the Description tab, review what the signature is protecting and what it provides.
If there is a link, click it to open a browser page and view more information on the
security threat.
4 Click
OK.
Creating custom signatures
Host Intrusion Prevention gives you the flexibility to create and manage your own
signatures and share them between policies. Creating custom signatures, which is
recommended only for advanced users, provides additional flexibility for your
environment. Refer to Writing Custom Signatures on page 164 for details.
You can use two methods to create signatures:
Signature Creation Wizard — This is the simplest method, but you cannot change
operations that the signature is protecting.
Standard Mode — This is the more advanced method that enables you to add or delete
operations that the signature is protecting.
Select... To view...
Show Active Signatures
Only the signatures that are active for the IPS Rules
policy. This is the default view.
Show Disabled Signatures
Only the signatures whose severity level is set to
disabled.
Show All Signatures
A combination of active and disabled signatures.
Note
You can modify the severity level of several signatures at one time by selecting the
signatures and clicking
Modify the Severity Level. In the dialog box that appears, select
Modified and the new severity level to be applied to the signatures, or select Default to
return the signatures to their default severity level. Click
OK to save the changes.
Severity Level settings include High, Medium, Low, Information, and Disabled.