Technical Tip: View IPS Signature details using FortiManager

[mpapisetty]

Description	This article describes how to view IPS signature details using FortiManager. There are times when security administrators must deep dive into a particular IPS alert to know why a signature got triggered. In such scenarios, viewing the IPS signature pattern is useful for identifying the issues at hand.
Scope	FortiManager.
Solution	Within any one ADOM, navigate to Policy & Objects -> Object Configurations -> Security Profiles -> Intrusion Prevention.  All the IPS profiles are listed on this page.  Edit the 'all_default' profile and select 'Create New'. In the 'Search...' box, input the name of the signature that is of interest and select the name to view the details. A sample signature is shown below: The 'Signature Details' section is the actual IPS signature pattern that is used by FortiGate to match traffic. With this information, security administrators can make informed decisions about the IPS alerts and matching traffic.  Related documents: Signature-based defense Technical Tip: How to configure custom IPS signature for a specific web site