Signatures

September 21, 2020

Contributed by:

Getting started with signatures

To add signature:

Select the Default-signature and click add to make a copy.
Give a meaningful name. The new sig object is added as a User-Defined object.
Enable the target rules that are pertinent to your specific need.
- The rules are disabled by default.
- more rules require more processing
Configure the actions:

Block and Log actions are enabled by default. Stats is another option
Set the signature to be used by your profile.

Tips for Using Signatures

Optimize the processing overhead by enabling only those signatures that are applicable for protecting your application.
Every pattern in the rule must match to trigger a signature match.
You can add your own customized rules to inspect incoming requests to detect various types of attacks, such as SQL injection or cross-site scripting attacks.
You can also add rules to inspect the responses to detect and block leakage of sensitive information such as credit card numbers.
Add multiple security check conditions to create your own customized check.

Best Practices for Using Signatures

Following are some of the best practices you can follow when encountered with issues related to Signatures:

Verify that the import command has succeeded on primary as well as secondary.
Verify that CLI and GUI outputs are consistent.
Check ns.log to identify any errors during signature import and auto update.
Check if the DNS name server is configured properly.
Check schema version incompatibility.
Check if the device is unable to access the Signature Update URL hosted on AWS for auto-update.
Check for the version mismatch between Default signature and user-added ones.
Check for version mismatch between signature objects on the primary and secondary nodes.
Monitor for High CPU Utilization (disable auto-update to rule out issue with signature update).

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Signatures

September 21, 2020

Contributed by:

September 21, 2020

Contributed by:

Signatures

Getting started with signatures

Tips for Using Signatures

Best Practices for Using Signatures

In this article