Create or clone an application

[BoDollis]

I would LOVE to create an application/AppID for SSh on an alternate port, e.h.10022 rather than 22.  I thought cloning the ssh AppID would be the way, but Clone is greyed out and unavailable.

Creating or adding an Application seems straight forward until I get to the Signatures tab. 

Can someone give me some guidance on this please?

[BPry]

@BoDollis,

So this kind of depends on how in-depth you want to get with the siganture and whether or not you truly need to utilize one. For example if I simply want the traffic to be identified you could utilize an application-override policy to note that any tcp/1022 traffic to server 'x' is going to be 'ssh'. Depending on the access rights to this server this may fit your needs perfectly fine. 

Alternatively you could create a custom app-id like what I've included here that simply gives you a different app to override the application too. 

<application version="8.0.0">
  <entry name="ssh-1022">
    <default>
      <port>
        <member>tcp/1022</member>
      </port>
    </default>
    <subcategory>encrypted-tunnel</subcategory>
    <category>networking</category>
    <technology>client-server</technology>
    <description>Alternative SSH Port</description>
    <risk>4</risk>
    <used-by-malware>yes</used-by-malware>
    <able-to-transfer-file>yes</able-to-transfer-file>
    <has-known-vulnerability>yes</has-known-vulnerability>
    <tunnel-other-application>yes</tunnel-other-application>
  </entry>
</application>

However if you want to go all out then you would utilize a signature to make sure that you are only matching the traffic that you actually intend to. Certaintly recommended and the best possible solution to something like this, but not necissarly needed in all situations. 

When you create a new signature you need to specify certain conditions that will only match this traffic, for example a condition may be that I'm looking at Context http-req-headers for the pattern 'docs.legis.wisconsin\.gov' and a Qualifier of http-method GET. This signature would be able to look at the GET request for docs.legis.wisconsin.gov and classify it as my custom app-id 'Legis-Docs'. 

I would recommend that you take a look at the following; both are great resources. 

App-ID Video:

Getting-Started Custom Applications and App Override: