How to create custom ips signature using dynamic pattern?

Forum|Forum|2 years ago
April 3, 2024
2 replies
2156 views

Hi,

I want to create custom ips signature. I can create signature using static pattern but I don't know how I can create using dynamic pattern. Pattern can be change but I want to block if I catch same pattern in time. Aynbody know how I can create custom ips signature using dymanic pattern?

Thank you

FortiGate

AEK

SuperUser

Hi @mmorcali

What do you mean exactly by dynamic pattern? Can you illustrate by an example?

AEK

mmorcaliAuthor

New Member

Hi @AEK

F-SBID( --attack_id 9236; --name "S1-AP.signature"; --severity high; --protocol 132; --pattern "|00 00 00 12|"; --pattern "|09 99|"; --rate 15,60;)

In this example I can catch staticly. But --pattern "|09 99|" can be change and I don't know all the patterns. I want to block when I catch same pattern in time.