topic Combination Custom IPS Signature in General Topics

Combination Custom IPS Signature

bhlee — Mon, 27 Jun 2011 05:34:58 GMT

Hello all.

quick question as to combination customer signature.

would you please give me your advise please?

- one of potential customer want their employee to forcely use company email server (when sending..) not thru the hotmail, gmail etc..

- I found that one of web email service change their URL when it's time to 'write' the email content.

e.g

http://mail2.daum.net/hanmailex/Top.daum?#cmd_ComposeMail

in the custom IPS signature .

1. event name : mail1_send
http-req-uri-path : hanmailex/Top.daum

action : alert

2. event name : mail2_send

http-req-uri-params : cmd_ComposeMail

action : alert

3. event name : daum_bocking.

in event 3. I chose the 'combination' and add upper 2 signature(mail1_send, mail2_send) in a row.

action : block.

will this work as my intention?(I failed.. firstly).. e.g) after alerting mail1_send, daum_blocking is populated on the fly, so just accessing that page also denied..

my intention is combined matching event daum_blocking was supposed to generated right after mail1_send and mail2_send event popped up..

I really apprecaite for this in advaces..

thank you very much.

Re: Combination Custom IPS Signature

fredallee — Mon, 27 Jun 2011 05:56:20 GMT

Your logic is correct in that you should be able to create individual custom signatures and use the combination signature to combine the 2 events together with an and operator. I can't comment whether or not your signatures are good enough to match the event that you want though. Did you also check/uncheck the ordered match criteria to enforce the order in which the signatures are triggered or not?

Re: Combination Custom IPS Signature

bhlee — Mon, 27 Jun 2011 06:14:46 GMT

yes I tried that.

would you please review the test procedure?

thank you very much.