38-23
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter 38 Defining IPS Signatures
Configuring Signatures
SubSignature ID The unique numerical value assigned to this subsignature. The
subsignature ID identifies a more granular version of a broad signature.
The value is 0 to 255.
Promiscuous Delta Modifies the seriousness of an alert when operating in promiscuous
mode. The value is subtracted from an alert’s overall risk rating. The
promiscuous delta is ignored when operating in inline mode. The value
can be 0 to 30.
Sig Description A description of the signature to help you distinguish this signature
from other signatures:
• Alert Notes—Additional information about this signature that will
be included in the alert message.
• User Comments—Your comments about the signature.
• Alarm Traits—Traits you want to document about this signature.
The value is 0 to 65535. The default is 0.
• Release—The release in which the signature was most recently
updated.
• Signature Creation Date—The date on which the signature was
created.
• Signature Type—The type of signature: Anomaly, Component,
Exploit, Vulnerability, or Other.
Engine The engine that parses and inspects the traffic specified by this
signature. The engine determines which parameters are available in the
Engines folder. For a description of the engines, see Engine Options,
page 38-17.
For detailed information about each engine, and the parameters
available, see the “Signature Engines” section in the Installing and
Using Cisco Intrusion Prevention System Device Manager document
for the IPS Software release you are using.
Tip Many engines include the Fragment Status parameter, which
lets you identify whether packet fragments should be inspected.
You can elect to not inspect fragments, to inspect fragments, or
to apply the signature to any packet status.
Table 38-5 Edit Signature Parameters Dialog Box (Continued)
Elements Description
