Filter
Top Products
38-22
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter 38 Defining IPS Signatures
Configuring Signatures
Navigation Path
From the Edit Signature or Add Custom Signature dialog boxes, click the Edit Parameters button. For
information on opening these dialog boxes, see Edit Signature or Add Custom Signature Dialog Boxes,
page 38-12.
Tip If the button is not active, you must first select Local or the name of a shared policy from the Source
Policy field, or clone the signature to create a custom policy. The Local option is available in Device
view only, and makes your changes apply to the device you are editing and to no other devices. If you
select the name of a shared policy, your changes apply to all devices that are assigned the policy.
Field Reference
Table 38-5 Edit Signature Parameters Dialog Box
Elements Description
Tuning Context
(Policy view only)
Displays the information needed by Security Manager to uniquely
describe how the signature parameters were edited (tuned) for a
particular signature policy. The Tuning Context field is a character
string that contains the following items:
• Context—The identification given by the Security Manager server
for the unique definition of this micro-engine.
• SigLevel (IPS) or Version (IOS IPS)—For IPS policies, the range
of signature update levels to which this definition of the signature
micro-engine applies. For IOS IPS, this is the IOS IPS version.
• Engine—The name of the IPS engine.
Tip As an example, the Tuning Context field could contain the
following character string: Context:9, SigLevel:302-449,
Engine:atomic-ip.
For any particular signature policy, the Tuning Context field can
contain one or many tuning contexts:
• The tuning context with the highest signature level is pre-pended
with "Reference context."
• If you modify the shared policy that is pre-pended with "Reference
context," Security Manager may ask you if you want to copy the
policy to other applicable contexts. (A particular device may
appear in more than one context.)
• If you choose to copy the policy to other applicable contexts, an
error message informs you if some parameters cannot be copied.
Note Beginning with Security Manager 4.1, old signature versions
(defined as being older than the lowest signature level
deployed) are purged during a periodic purge operation, the
purpose of which is to optimize the database. As a result, you
may notice the deletion of some of your unused tuning contexts.
Signature ID The unique numerical value assigned to this signature. This value lets
the sensor identify a particular signature.
The value is 1000 to 65000.