Filter
Top Products
52
McAfee
®
Host Intrusion Prevention 6.1 Product Guide IPS Policies
IPS Rules policy details
4
.
5 Click Apply to apply the new settings, and then OK.
Editing custom signatures
You can edit custom signatures to add, remove, or modify rules or other data contained
within the signature.
To edit a custom signature:
1 On the
Signature tab, double-click the custom signature you want to edit.
The Custom Signature Properties dialog box appears.
2 Make changes on each tab as needed. Click Help in the dialog box for details.
3 Click
OK to save the changes.
Deleting custom signatures
In addition to creating and editing custom signatures, you can also delete them. When
you delete a custom signature, all existing events that were triggered by this signature
will have the signature ID appended to its name in the
IPS Events tab.
To delete a custom signature:
1 On the
Signature tab, select the custom signature you want to delete and click Delete
on the shorcut menu or the toolbar.
2 In the dialog box that appears asking to confirm the deletion, click
OK.
To use Standard Method: To use Expert Method:
The Standard Method limits the number of
types you can include in the signature rule.
The Expert Method, recommended only for
advanced users, enables you to provide the
rule syntax without limiting the number of
types you can include in the signature rule.
Before writing a rule, make sure you
understand rule syntax. Refer to Writing
Custom Signatures on page 164.
1Click
Add. The New Standard Rule dialog
box appears.
2 On the
General tab, enter a name for the
signature and choose a type.
3 On the
Operations tab, specify the
operations that trigger the selected rule.
4 On the
Parameters tab, include or exclude
particular parameters in the rule.
5 On the
Rule Syntax tab, view the rule
syntax that was generated for the
signature you are creating.
6Click
OK. The rule is compiled and the
syntax is verified. If there is an error and
the rule fails verification, a dialog box
describing the error appears. You can
then fix the error and verify the rule again.
1 On the
Rules tab of the Custom Signature
dialog box, select
Expert and
2 Click
Add. The New Expert Rule dialog
box appears.
3 On the
General tab, type a name for the
rule in the
Rule Name box and any notes
in the
Note box.
4 On the
Rule Syntax tab, type the rule.
Rules are written in ANSI format and
TCL syntax. See Writing Custom
Signatures on page 164 for details.
5 Click
OK. The rule is compiled and the
syntax is verified. If there is an error and
the rule(s) fails verification, a dialog box
describing the error appears. You can
then fix the error and verify the rule
again.
Note
You can include multiple rules in a signature.