Skip to main content
DanieleS99
DanieleS99
Explorer
February 8, 2022
Solved

IPS add signatures best practice

  • February 8, 2022
  • 1 reply
  • 1807 views

Hi,

I wanted to figure out the best way to add signatures to protect a particular service, and make sure I have everything included.
For example how could I filter or IPS signatures to properly secure OWA? Or to protect web servers?

 

Thanks

Best answer by AlexC-FTNT

Generally you need to know what attacks are applicable for a specific environment.

Sometimes, the server is already patched against 90% of attacks and vulnerable to only few attacks (you would know that from their bulletins)

This often means a lot of work to isolate and keep the ips sensor updated with the most recent signatures, so another approach is common: filtering the IPS signatures by categories (you have predefined some categories when you add the signatures: by target client/server, by severity of the attack, by protocol, by OS,by application).

For example, for an OWA server (mail server), you can use the "MS_Exchange" application filter, or the OS "Windows" filter, or even the "SMTP" or "SMTPS" protocol filter. You can add more of these filters in the same IPS profile.

1 reply

AlexC-FTNT
Staff
AlexC-FTNTAnswer
Staff
February 9, 2022

Generally you need to know what attacks are applicable for a specific environment.

Sometimes, the server is already patched against 90% of attacks and vulnerable to only few attacks (you would know that from their bulletins)

This often means a lot of work to isolate and keep the ips sensor updated with the most recent signatures, so another approach is common: filtering the IPS signatures by categories (you have predefined some categories when you add the signatures: by target client/server, by severity of the attack, by protocol, by OS,by application).

For example, for an OWA server (mail server), you can use the "MS_Exchange" application filter, or the OS "Windows" filter, or even the "SMTP" or "SMTPS" protocol filter. You can add more of these filters in the same IPS profile.

Terms & ConditionsAccessibility statement