Logical conditions in custom IPS signatures

Reply
L5 Sessionator

Logical conditions in custom IPS signatures

Hello.

I need some help with logical conditions in custom IPS signatures definitions.

I've made a set of custom IPS signatures for browser identification based on user agent strings. the were working ok, but recently MS decided that IE will not include string MSIE in some cases. So I'm making a new signature which will try to find MSIE or Trident (a string which only IE of major browsers uses).


Currently I have old signature which searches for MSIE and is working ok:

ie1.jpg

Now I made a new signature which should trigger on MSIE OR Trident string:

ie2.jpg

But the second signature never triggers. Why? It should trigger on the same user agent strings as first one and more.

I'm also curious if some other ppl are trying to make (and maintain) browser identification signatures. Or if someone knows a trustworthy source of regular expressions for user agents.

L5 Sessionator

Re: Logical conditions in custom IPS signatures

Nevermind this, the configuration was correct, my diagnostics weren't.

L4 Transporter

Re: Logical conditions in custom IPS signatures

Thanks for the update Santonic as I could see nothing wrong and was about to say "time for the wireshark packet capture to see what the available data looks like".  Good luck with your signatures. I have written a lot over the past 2 years and they have proven to be useful.

Phil

L5 Sessionator

Re: Logical conditions in custom IPS signatures

Thank you for effort. What signatures are you making? For browser ID?

L4 Transporter

Re: Logical conditions in custom IPS signatures

Asntonic

We have written signatures for malicious intended web requests and to block the downloading of specific files (adware, toolbars, undesired software).

Phil

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!