IPS Signature Engine

Hello,
While Checking IPS signature database, i noticed that there is a column named engine.
Some signatures are Atomic IP, others Normalizer, i don't know if there is a third value.
but what do that values means?
One more question, if a signature Action is set to "block attacker inline" it do block the attacker address IP for a one hour right?
Also is there a way to know from IPS what are the group of IP's blocked for one hour and when??

First, let me clarify the differences between blocking actions and deny actions:
block - relies on an external device, such as a firewall or router, to implement the action via a shun or ACL entry
deny - performs the action directly on the IPS sensor, requires the sensor to be configured for inline operation
All of the output provided in the output of the 'show statistics network-access' relates to block actions. 'AllowSensorBlock' is a parameter that allows the IPS sensor to add its management IP address to a requested block action; this is not usually recommended. To adjust the timeout for blocks to remain active you would make use of the 'global-block-timeout' command from the CLI:
sensor# configure terminal
sensor(config)# service event-action-rules rules0
sensor(config-rul)#
sensor(config-rul)# general
sensor(config-rul-gen)# global-block-timeout 30
The timeout is specified in minutes.
For deny actions you can adjust the timeout using the 'global-deny-timeout command:
sensor# configure terminal
sensor(config)# service event-action-rules rules0
sensor(config-rul)#
sensor(config-rul)# general
sensor(config-rul-gen)# global-deny-timeout 1800
The timeout is specified in seconds.
To adjust timeouts using the IDM GUI, please reference this documentation link:
http://www.cisco.com/en/US/docs/security/ips/6.2/configuration/guide/idm/idm_event_action_rules.html#wp2039284
You can monitor active blocks from the CLI using the 'show statistics network-access' command.
You can monitor active denies from the CLI using the 'show statistics denied-attackers' command.
To monitor blocks and denies using the IDM GUI, please reference this documentation link:
http://www.cisco.com/en/US/docs/security/ips/6.2/configuration/guide/idm/idm_monitoring.html
There is not a direct method within the sensor to view historical block/deny lists.
Scott

Similar Messages

CSM 3.1.0 doesn't update IPS signature after E2 engine

Hi!:
I have updated my IDS/IPS with E2 engine but now with CSM when I try to update my IDS, with a new signature, I received the next message:
"There is no package to update sensor, sensor is up to date"
I have in CSM S344 signature and my sensor have S342
Is possible to update signatures with CSM 3.1.0 after E2 engine?
Thank you
Alex

Refer to the following url for more info on upgrading to latest IPS signatures:
http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6634/prod_white_paper0900aecd8066d280.html
also refer the link below for more info on signature upgrade:
http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/ips_v5.html

Is it really possible to revert IPS signatures from CSM

Hi folks,
I've been trying to revert IPS signatures that I deployed through CSM Signature policies to the older release but it doesn't seem to be working. Contrary to it Cisco's CSM guide says:
If you later decide that you did not want to apply a signature update, you can revert to the
previous update level by selecting the Signatures policy on the device, clicking the View
Update Level button, and clicking Revert
I can't imagine it is possible as the signatures are normally compiled into xml files. How would the sensor do it ?
Eugene

During installation a copy of files that will be replaced or updated during the installation will be copied into a backup directory.
The CLI has a "downgrade" command that can uninstall the last update, and the backup copies will be used to replace the files being removed.
A few things to be aware of:
1) Old configuration will be copied back. So changes made since the update may be lost.
2) This works only for Engine Updates and Signature Updates. Major Updates, Minor Updates, and Service Packs replace the complete operating system so there is too much data to try and make backup copies for.
3) This works only for the last update installed. Once you've downgraded the latest one, you can't downgrade the previous one.
4) This can be done through CLI, and now also available in CSM.
Here are some things to check in your situation where it appears to not be working.
Login to the sensor and execute "show ver".
Does the history in the "show ver" output show a Signature Update package as the last update installed?
If not then either another downgrade was previously done, or a Major Update, Minor Update, or Service Pack was the last package installed and can't be downgraded.
If it can't be done through CSM you might try the CLI' "downgrade" command and see if it works through the CLI or if the CLI gives you an error and explanation.

How to upgrade IPS Signature

Can anyone help me with the steps of upgrading the IPS signature for the platform ASA SSM-20, IDS 4215, WV-SVC-IDSM-2 via IDM and IME. All the sensors are already upgraded with Engine E4 with signature S480.
Can I upgrade the signature directly from S480 to S507? Please let me know the file which I need to download. Is there any impact while updating the signture like reboot?

Hi Gangadaran,
We can apply the same package on all the mentioned platforms. It can be applied to all below platforms:
- IPS-42xx Cisco Intrusion Prevention System (IPS) sensors
- IDS-42xx Cisco Intrusion Detection System (IDS) sensors (except the IDS-4220, and IDS-4230)
- WS-SVC-IDSM2 series Intrusion Detection System Module (IDSM2)
- NM-CIDS IDS Network Module for Cisco 26xx, 3680, and 37xx Router Families.
- ASA-SSM-10 Cisco ASA Advanced Inspection and Prevention Security Services Module (Requires ASA)
- ASA-SSM-20 Cisco ASA Advanced Inspection and Prevention Security Services Module (Requires ASA)
- ASA-SSM-40 Cisco ASA Advanced Inspection and Prevention Security Services Module (Requires ASA)
- AIM-IPS Cisco Advanced Integration Module for ISR Routers
Refer the readme for all details:
http://www.cisco.com/web/software/282549755/37074/IPS-sig-S507.readme.txt
All the best!!
Thanks,
Prapanch

Upgrade AIP SSM with Signature Engine 4 file

When I tried to upload Signature Engine 4 file (IPS-engine-E4-req-7.0-2.pkg), using FTP server both by CLI and IDM, to new AIP SSM sensor, I got the following error message:
Cannot upgrade software on the sensor - socket error:110.
When I tried to do the same by using these steps: IDM --> Configuration --> Sensor Management --> Update Sensor --> choose Update is located on this client --> choose the "IPS-K9-7.0-2-E4.pkg" file --> hit the "Update Sensor" button, I got the following error message
The current signature level is S480.The current signature level must be less than s480 for this package to install.
Here is the output for sh ver command
AIP_SSM# sh version
Application Partition:
Cisco Intrusion Prevention System, Version 7.0(2)E4
Host:
    Realm Keys          key1.0
Signature Definition:
    Signature Update    S480.0                   2010-03-24
OS Version:             2.4.30-IDS-smp-bigphys
Platform:               ASA-SSM-10
Serial Number:          JAF1514BAHS
Licensed, expires:      07-Jun-2012 UTC
Sensor up-time is 21 days.
Using 695943168 out of 1032495104 bytes of available memory (67% usage)
system is using 17.4M out of 38.5M bytes of available disk space (45% usage)
application-data is using 45.4M out of 166.8M bytes of available disk space (29% usage)
boot is using 41.6M out of 68.6M bytes of available disk space (64% usage)
application-log is using 123.5M out of 513.0M bytes of available disk space (24% usage)
MainApp            B-BEAU_2009_OCT_15_08_07_7_0_1_111   (Ipsbuild)   2009-10-15T08:09:06-0500   Running
AnalysisEngine     BE-BEAU_E4_2010_MAR_25_02_09_7_0_2   (Ipsbuild)   2010-03-25T02:11:05-0500   Running
CollaborationApp   B-BEAU_2009_OCT_15_08_07_7_0_1_111   (Ipsbuild)   2009-10-15T08:09:06-0500   Running
CLI                B-BEAU_2009_OCT_15_08_07_7_0_1_111   (Ipsbuild)   2009-10-15T08:09:06-0500
Upgrade History:
IPS-K9-7.0-2-E4   02:00:07 UTC Thu Mar 25 2010
Recovery Partition Version 1.1 - 7.0(2)E4
Host Certificate Valid from: 30-May-2011 to 30-May-2013
Any idea what could be the problem?
Regards,

Based on your show version, you already have E4, what is it that you are trying to do?
Mike

Defect in current IPS signatures causing crashes

In the "Caveats" section of the just-released S392 IPS signature update, Cisco acknowledges a "defect present" in the memory managerÂ which they're working on, but which can (ie very likely in our experience with our AIP-SSM-10 module and S389) cause the update to fail and requiring a manual power recycle of the ASA, leaving you back where you started -- hopefully, with the module up and current signature active, or at worse, unable to start up the AIP-SSM module.
Having had this happen to us, we are going to hold off going ahead with the upgrade, as we would be guaranteed to go through an unnecessary and unproductive ordeal. Â Â I would like to know of other users' experience with recent signatures, at least as new as S389.

I've experienced the same thing happening on several IPS that I manage going back to a few months even. Certainly is a pain in the neck to have your IDS come up after the upgrade but the anal engine not be running and require a reboot of the device.

E2 Engine Update released alongwith new signature engine(s)

Dear All
For those interested, the E2 Engine Update has finally been released a couple of days ago. Signature 339 is bundled with it. It also contains new and improved signature engines like P2P engine, FIXED engine etc. Also some very promising P2P detection signatures are included in the SIG # 339 release. Have a look at:
http://tools.cisco.com/MySDN/Intelligence/viewBulletin.x?bi=157
http://download-sj.cisco.com/cisco/crypto/3DES/ciscosecure/ips/6.x/IPS-engine-E2.readme.txt
Regards
Farrukh

Not sure why you rated my post so low.
It was not meant to be a final answer, but rather a list of questions for you to answer in order for me to provide you a detailed answer.
I need to know your sensor models and versions in order to let you know specifically what packages you need to download and install.
If you are using an IPS-4260 it is a different set of packages than if using other sensor models, but only if staying at version 5.1. If going to 6.0 or 6.1 it uses the standard packages instead of special ones.
If you were running 5.1(6)E2 versus 5.1(7) then it is a different set of files as well.
From 5.1(6) you had to upgrade all the way to 5.1(8)E2. If running 5.1(7)E1 then you could just upgrade to 5.1(7)E2 OR to 5.1(8)E2.
If you try going to 6.0 or 6.1 it is again a different set of packages.
Based on your latest response I assume you were able to figure it out.
As for upgrading to 6.0(5)E2 and/or 6.1(1)E2 it once again depends on your specific sensor models.
If using IPS-4210, then NO you have to stay at version 5.1(8)E2. The IDS-4210 is not supported in 6.0.
If using IPS-4215, IDS-4235, IPS-4240, IDS-4250, IPS-4255, IPS-4260, IDSM-2, NM-CIDS, SSM-10, or SSM-20; then yes you can upgrade to 6.0(5)E2 (assuming you have an up to date contract).
If using IPS-4240, IPS-4255, IPS-4260, IDSM-2, SSM-10, or SSM-20; then yes you can upgrade to 6.1(1)E2 (assuming you have an up to date contract). The IDS-4215, IDS-4235, IDS-4250, and NM-CIDS are not supported in 6.1.

WRVS4400N v2: IPS SIGNATURES || 365 days without an update??

Good day!
I wanted to know how often Cisco determines it should be releasing new updated IPS signatures to ensure customers are being adequately protected from the latest threats? That is for those of us who choose to use the feature.
https://supportforums.cisco.com/message/3419502#3419502
As you can see in the last posting about this very issue, it took Cisco over 365 days to release one signle IPS file.
Is the IPS file comparable to a virus definition file? Or does the IPS file simply not require being updated by Cisco... for years at a time.
I'm finding that development on updated IPS files are being neglected by the Cisco development team.
It will soon be comming up to August 9, 2012. That will make the last published IPS update 365 days old.
Thanks for any insight you may provide.
Sincerely,
Christopher Laurie

We should all get regular IPS updates, but I undersand some of the reasons why it could be tough to provide IPS signature updates for your device. Basically you have an IPS *on/off* switch. Therefore they have to be certain that ALL of the signatures aren't too sensitive. Otherwise you would be forced to turn the functionality 'off'.
The SA500 Series routers have a little more flexibility to configure IPS. IPS signatures can be turned on/off at the signature-level.
The enterprise-level IPS modules have 10 times the flexibility, are much more robust, and are highly configurable. Custom IPS signatures can even be created by the end user.
All in all, we are dealing with 3 different types of IPS signatures and IPS engine implementations. That said, your device really needs IPS signature updates at least 3 or 4 times a year to be effective. We used to have a WRVS4400N v2 so I understand where you're coming from.

User account to download Cisco IPS signature

Hi All,
I wanted to enable the Autoupdate in IPS but it asks for Cisco acc with cryptographic privileges to download Cisco IPS signature and signature engine updates from Cisco.com.
is their any default acc for this ?
I have CCO acc whether is this can be used ?
You must have a Cisco.com user account with cryptographic privileges to download Cisco IPS signature and signature engine updates from Cisco.com.

Using your cisco.com account go to this link and see if you can download the IPS-K9-6.1-2-E3.pkg file to your own desktop machine.
http://tools.cisco.com/support/downloads/go/ImageList.x?relVer=6.1%282%29E3&mdfid=280302728&sftType=Intrusion+Prevention+System+%28IPS%29+System+Upgrades&optPlat=&nodecount=2&edesignator=null&modelName=Cisco+IPS+4260+Sensor&treeMdfId=278875311&treeName=Intrusion+Prevention+System+%28IPS%29&modifmdfid=null&imname=&hybrid=Y&imst=N&lr=Y
If you can download this file with your account, then you can use that account and password when configuring the sensor for the cisco.com automatic upgrades.
If you can not download the file with your account, then your account does not have the right settings.
Either your account does not have crypto access or your account is not properly linked to your service contract for your sensors.
There are a handfull of countries not allowed to have crypto access, users from all other countries would just need to get their account modified for crypto access (I am not sure what that procedure is).

Correct procedure to update IOS IPS signatures on 2911 router

What is the correct procedure to update the IOS IPS signatures on an 2911 router?
I know how to download the signatures file (eg. IOS-S556-CLI.pkg) but what is the correct way to install the update?
Thank you in advance!

The IPS signature package comes with a list of pre-enabled signatures, hence Cisco does not recommend enabling a lot more other signatures, especially not every single signature as documented.
The reason why is because the package might include retired/old signatures only for references, and not every single signature is required to protect your environment because you might not have the traffic for some signatures, you might not have some end hosts that are written with specific signatures, therefore, it becomes irrelevant if you enable it.
Typically here is how customer would enable/disable signatures:
- Use the default signature that is enabled by Cisco (the default should fit majority of the customers).
- Monitor it for a couple of months
- Disable those that you don't need, and enable others if you think you require it for specific.

How to convert Cisco IPS signatures to a MARS events - no keyword search

I am trying to run a scheduled report looking for the new Microsoft exploit under the IPS S411 release, SIGID 19339.0 and I am trying to form the query looking for the event this falls under without using a keyword search on the SIGID. Does anyone know how to correlate an IPS signature to a MARS event?
Thanks,
Mike

With the help of On-box local event correlation technology you can correlate. On-box local event correlation technology not only enables detection, but actually blocks multi-event attacks and malware in real time, complementing security incident management software such as the Cisco Security Monitoring, Analysis, and Reporting System (Cisco Security MARS) that correlate events across multiple devices.
Integrates with the Cisco Security Manager to correlate security events with the configured firewall rules and intrusion prevention system (IPS) signatures that can affect the security event

Where do IPS signature save at?

Hi
i successfully load the IOS IPS package into the router, verify via CLI and CCP the IPS signature did compile on the router. (advanced mode, around 588 signature is active)
but it went gone (happened twice), i just want to ensure few things
1. i did shut down my router, and migrate to production site, would it cause by the power off / on then IPS signature missing?
2. i did remove the "ip ips iosips in/out" command that previous apply at my interface, would this cause the IPS disable and gone?
just counldn't figure out why now my router only have 3 signature only..
thanks

1. Please use the doc below for reference on how to configure IOS-IPS on the router. I will try to answer your questions using this document.
http://tools.cisco.com/squish/9Be6a
2. You will see in step 2.1 we create directory on flash to store all the signature files and configurations.
e.g:
mkdir
router#mkdir ips
Create directory filename [ips]
Created dir flash:ips
3. In step 4.2 , we configure IPS signature storage location by referencing the directory we created above.
e.g:
ip ips config location flash:
router(config)#ip ips config location flash:ips
This is where the signature files will be stored.
4. In step 5.1 we copy the signature files to the router.
e.g:
router#copy ftp://cisco:[email protected]/IOS-S310-CLI.pkg idconf
Loading IOS-S310-CLI.pkg !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[OK - 7608873/4096 bytes]
The idconf command compiles the signature after the file is copied.
5. If all the above steps are done correctly, you should see the following files in flash:
router#dir ips
Directory of flash:/ips/
7 -rw- 203419 Feb 14 2008 16:45:24 -08:00 router-sigdef-default.xml <----Contains factory default signature definitions.
8 -rw- 271 Feb 14 2008 16:43:36 -08:00 router-sigdef-delta.xml
9 -rw- 6159 Feb 14 2008 16:44:24 -08:00 router-sigdef-typedef.xml
10 -rw- 22873 Feb 14 2008 16:44:26 -08:00 router-sigdef-category.xml
11 -rw- 257 Feb 14 2008 16:43:36 -08:00 router-seap-delta.xml
12 -rw- 491 Feb 14 2008 16:43:36 -08:00 router-seap-typedef.xml
64016384 bytes total (12693504 bytes free)
6. Make sure you do a 'Router#write memory' before you reload the router. This way the configuration done gets stored and is preserved after reboot.
Also make sure your configuration register on the router is correctly set to 0x2102.
Sid Chandrachud
TAC security solutions

IOS IPS Signature-File

Hi Guys,
We have recently purchased a Cisco ISR 2921, and on its docs it is writen that this product has a License for IOS IPS Signatrue File, but on the product Flash Memory there is no IOS IPS Sig-File.   and while i try to download the sig-file from Cisco, it fails.
Can any one tell me where is an alternate way to download the sig-file ?

900 active signatures is quite much for a system that has no dedicated IPS-ressources.
But you can controll which and how many signatures get enabled on your router:
In the following example I first disable all signatures and enable the ones for web-servers. So just decide which signatures you need. But don't forget to monitor your router-ressources.
gw#conf t
Enter configuration commands, one per line. End with CNTL/Z.
gw(config)#ip ips signature-category
gw(config-ips-category)#?
IPS signature category configuration commands:
category Category keyword
exit      Exit from Category Mode
no        Negate or set default values of a command
gw(config-ips-category)#category ?
adware/spyware                Adware/Spyware (more sub-categories)
all                           All Categories
attack                        Attack (more sub-categories)
configurations                Configurations (more sub-categories)
ddos                          DDoS (more sub-categories)
dos                           DoS (more sub-categories)
email                         Email (more sub-categories)
instant_messaging             Instant Messaging (more sub-categories)
ios_ips                       IOS IPS (more sub-categories)
l2/l3/l4_protocol             L2/L3/L4 Protocol (more sub-categories)
network_services              Network Services (more sub-categories)
os                            OS (more sub-categories)
other_services                Other Services (more sub-categories)
p2p                           P2P (more sub-categories)
reconnaissance                Reconnaissance (more sub-categories)
releases                      Releases (more sub-categories)
specially_licensed_signature Specially Licensed Signature (more sub-categories)
telepresence                  TelePresence (more sub-categories)
uc_protection                 UC Protection (more sub-categories)
viruses/worms/trojans         Viruses/Worms/Trojans (more sub-categories)
web_server                    Web Server (more sub-categories)
gw(config-ips-category)#category all
gw(config-ips-category-action)#retire true
gw(config-ips-category-action)#exit
gw(config-ips-category)#category web_server
gw(config-ips-category-action)#?
Category Options for configuration:
alert-severity   Alarm Severity Rating
enabled          Enable Category Signatures
event-action     Action
exit             Exit from Category Actions Mode
fidelity-rating Signature Fidelity Rating
no               Negate or set default values of a command
retired          Retire Category Signatures
gw(config-ips-category-action)#retired false
gw(config-ips-category-action)#exit
gw(config-ips-category)#exit
Do you want to accept these changes? [confirm]
gw(config)#
gw(config)#exit
gw#sh ip ips configuration | s IPS Signature Status
IPS Signature Status
    Total Active Signatures: 131
    Total Inactive Signatures: 4370
gw#
I didn't follow the thread and answered your first post to have less line-breaks in this post.

IOS IPS Signature Updates

Hi,
Is it possible to update signatures for IOS IPS or do we need to update the IOS to get more signatures?
Thanks and rgds
Rajesh

hi,
if you have cisco sdm, then it would be easy to update your IOS IPS signatures. You may need to upgrade IOS of the router only when the ips signature requires you to do it.

Tune IPS Signature

Hi,
I want to to tune IPS signature so that it can make exception of ip addresses.
the signature is 13004 (this is UDP scan signature) i have ciscoworks in my network which scan the network using UDP i dont want to disable the signature i just want to add the ip address of ciscoworks to safe list ( if it exists) i have configured the alert to be sent to my email and i got alot of those emails which says
high 13004-0 "AD - External UDP Scanner" x.y.z.w/src_port(*) 0.0.0.0/dest_port(*)
thanks

Alakabeer -
You want to configure an Event Action Rule for this signature with the IP address of your Ciscoworks host in the Event Action Variable:
http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_event_action_rules.html#wp1032319
- Bob

IPS Signature Engine

Similar Messages

Maybe you are looking for