[Contents]
[Prev]
[Next]
[Index]
[Report an Error]
Compound Attack Objects
A compound attack object combines multiple signatures and/or
protocol anomalies into a single object. Traffic must match all of
the combined signatures and/or protocol anomalies to match the compound
attack object; you can specify the order in which signatures or anomalies
must match. Use compound attack objects to refine your IDP policy
rules, reduce false positives, and increase detection accuracy. A
compound attack object enables you to be very specific about the events
that need to occur before IDP identifies traffic as an attack. You
can use And, Or, and Ordered and operations
to define the relationship among different attack objects within a
compound attack and the order in which events occur.
[Contents]
[Prev]
[Next]
[Index]
[Report an Error]
