The IPS sensor trigger for a custom signature with severity low

[todfra]

Hi everyone! I set custom IPS signature on FGT 7.0.2: config ips custom edit "TCP.SYN.Rate.Limit" set signature "F-SBID( --attack_id 7313; --name TCP.SYN.Rate.Limit; --protocol tcp; --tcp_flags S+; --flow from_client; --rate 3,60,limit; --track src_ip; )" set severity low set location server set comment "An attempt to prevent brute-force attacks to a TCP server." next end but it's triggering the IPS-Default sensor which is set as follows: config ips sensor edit "IPS-default" set comment "Prevent critical attacks." config entries edit 1 set severity medium high critical next end next end By checking IPS Event Logs can see that the unit is erroneusly processing the custom IPS signature as "Critical". Intrusion Prevention Profile Name IPS-default Attack Name TCP.SYN.Rate.Limit Attack ID 7313 Incident Serial No. 112889839 Direction outgoing Severity critical Message custom: TCP.SYN.Rate.Limit Why IPS sensor trigger for a custom signature with severity set low? Thank you!

[vweis]

Hello Todfra,

I have this same problem for my custom signatures on 7.0.5. No matter what I set the severity to, the IPS engine tags them as "critical". Going to look into this...

Will be in touch,
Victor

[vweis]

Hello Todfra,

I have learned that the CLI option for severity does nothing, and that you actually have to set the severity level in the signature string itself, with "--severity < info | low | medium | high | critical". 

This was not at all clear in the documentation, so I have reached out to the documentation team to request that this get added.

Cheers,
Victor