Create IPS or Exempt Rules

Rule Name

CSO generates a unique rule name by default. You can modify the name if needed.

The name must begin with an alphanumeric character and can contain alphanumeric characters and some special characters (colons, hyphens, forward slashes, periods, and underscores); 63-character maximum.

IPS Signatures

You can add one or more IPS signatures and IPS signature static and dynamic groups to be associated with the rule:

Procedure

1. Click inside the text box with the + icon.

   A list of IPS signatures and IPS signature static and dynamic groups appears.

2. (Optional) Enter a search term and press Enter to filter the list of items displayed.
3. Click a list item to add it to the IPS signatures and IPS signature static or dynamic groups associated with the rule.
4. (Optional) Repeat the preceding step to add more signatures, static groups, and dynamic groups.
5. Click the View more results link to view the full list of IPS signatures and IPS signature static and dynamic groups. The full list is displayed in the End Points panel on the right.

   To add one or more signatures, static groups, or dynamic groups:

   Procedure

   1. Mouse over a list item and select the check box that appears.
   2. Repeat the preceding step for the other signatures, static groups, or dynamic groups that you want to add.
   3. Click the check mark icon ( ✓ ) at the top of the End Points panel, and select Signatures.

      The signatures, static groups, or dynamic groups that you selected are added and displayed in the IPS Signatures field.

Additional Actions

In addition to the IPS action, you can configure one or more of the following additional actions:

• Notifications—When attacks are detected, you can choose to log the attack and create log records with attack information and send that information to the log server.

  Procedure

  To configure notifications:

  1. Click the Notification link.

     The Notification page appears.

  2. Complete the configuration according to the guidelines shown in Table 270.
  3. Click OK.

     You are returned to the previous page. A gear icon next to the Notification link indicates that you have configured notification settings.

• IP actions—When attacks are detected, you can configure actions that you want IPS to take against future connections that use the same IP address.

  Procedure

  To configure IP actions:

  1. Click the IP Action link.

     The IP Action page appears.

  2. Complete the configuration according to the guidelines shown in Table 271.
  3. Click OK.

     You are returned to the previous page. A gear icon next to the IP Action link indicates that you have configured IP action settings.

• Additional actions—When attacks are detected, you can configure additional actions that you want CSO to take.

  Procedure

  To configure additional actions:

  1. Click the Additional link.

     The Additional page appears.

  2. Complete the configuration according to the guidelines shown in Table 272.
  3. Click OK.

     You are returned to the previous page. A gear icon next to the Additional link indicates that you have configured additional settings.

Attack Logging

Select the Enable check box to log an attack when it is detected.

Log Packets

Select the Enable check box to log packets when an attack is detected.

In response to a rule match, you can capture the packets received before and after the attack for further offline analysis of attacker behavior. You can configure the number of pre-attack and post-attack packets to be captured for this attack, and limit the duration of post-attack packet capture by specifying a timeout value.

You must specify at least one of the Packets Before, Packets After, or Post Window Timeout fields.

Packets After

Specify the number of packets received after an attack that should be captured for further analysis of attacker behavior.

Range: 1 through 255.

IP Action

Select the action to be taken on future connections that use the same IP address:

Note: If there is an IP action match with more than one rule, then the most severe IP action of all the matched rules is applied. In decreasing order of severity, the actions are block, close, and notify.

• None (default)—Do not take any action. This is similar to if you did not configure the IP action.

• IP Notify—Don’t take any action on future traffic but log the event.

• IP Close—Close future connections of new sessions that match the IP address by sending RST packets to the client and server.

• IP Block—Block future connections of any session that matches the IP address.

Refresh Timeout

Select the Enable check box to refresh the IP action timeout (that you specify in the Timeout Value field) if future traffic matches the IP actions configured.

Log Taken

Select the Enable check box to log the information about the IP action against the traffic that matches a rule.

Severity

Select a severity level to override the inherited attack severity in the rules.

The most dangerous level is critical, which attempts to crash your server or gain control of your network. Informational is the least dangerous level and is used by network administrators to discover holes in their security systems.