Combination Custom IPS Signature

[bhlee]

Hello all.

quick question as to combination customer signature.

would you please give me your advise please?

- one of potential customer want their employee to forcely use company email server (when sending..) not thru the hotmail, gmail etc..

- I found that one of web email service change their URL when  it's time to 'write' the email content.

e.g

http://mail2.daum.net/hanmailex/Top.daum?#cmd_ComposeMail

in the custom IPS signature .

1. event name : mail1_send
http-req-uri-path : hanmailex/Top.daum

action : alert

2. event name : mail2_send

http-req-uri-params : cmd_ComposeMail

action : alert

3. event name : daum_bocking.

in event 3. I chose the 'combination'  and add upper 2 signature(mail1_send, mail2_send) in a row.

action : block.

will this work as my intention?(I failed.. firstly).. e.g) after alerting mail1_send, daum_blocking is populated on the fly, so just accessing that page also denied..

my intention is combined matching event daum_blocking was supposed to generated right after mail1_send and mail2_send event popped up..

I really apprecaite for this in advaces..

thank you very much.

[fredallee]

Your logic is correct in that you should be able to create individual custom signatures and use the combination signature to combine the 2 events together with an and operator. I can't comment whether or not your signatures are good enough to match the event that you want though. Did you also check/uncheck the ordered match criteria to enforce the order in which the signatures are triggered or not?

[bhlee]

yes I tried that.

would you please review the test procedure?

thank you very much.