Signature Parameters Common Signature Parameters Signature ID Sub

Signature Parameters Common Signature Parameters Signature ID Sub. Sig ID Alert Severity (H, M, L, I) Sig Fidelity (0 -100) Promis delta (0 -30) Sig Name TO FIRE THE SIG Event Count Event count Key Aa. Bb Interval TO GENERATE ALERT Summary Mode Summary Key Aa. Bb Summary Threshold Global Summary Threshold Summary Interval Enabled/Retired Specific Signature Parameters Atomic IP Engine Parameters IP Addr Options IP Payload length TCP Mask urg, ack, psh, rst, syn, fin TCP flags urg, ack, psh, rst, syn, fin Signature Actions TVR ASR Non Aggressive Actions Target Asset value Potential Damage SFR/PD Risk Rating WLR (CSA) Clues from Others Signature Accuracy ARR/OS Attack Relevancy RR= (ASR*TVR*SFR/10000) +ARR –PD +WLR ASR = Attack Severity rating Info (25) Low (50) Med (75) High (100) TVR = Target Value rating Zero (50) Low (75) Med (100) High (150) Critical (200) SFR = Signature Fidelity rating (0 -100) PD = Promiscuous delta (0 -30) minus value ARR = Attack Relevancy Rating Relevant (10) unknown (0) Not relevant (-10) WLR = watch List rating (0 -100) Produce Alert Produce Verbose Alert Log Attacker Packets Log Victim Packets Log pair Packets Request SNMP trap Aggressive Actions Deny Packet Inline (Single) Deny Connection Inline (udp/tcp) Deny Attacker Inline (S/IP) Deny Attacker-Victim pair Inline (S/IP & D/IP) Deny Attacker-service pair Inline (S/IP to D/Port) Reset TCP Connection Request Block Host Request rate Limit Modify Packet Inline Event Action Overides Based on RR category Add actions Event Action Filters Based on RR category & others Delete actions

Summary Key XXXX Aa. Bb TRAFFIC 1 60 secs 100 Matches = 100 alerts Aa=Attack Bb=Victim Uppercase=IP Lowercase=port 0 TRAFFIC 2 0 60 secs 160 Matches = 150 alerts TRAFFIC 3 0 60 secs 320 matches = 150 alerts Criteria Sig ID = 60000 Summary Mode: Fire All Summary Threshold: 150 Global Summary Threshold: 300 Summary Interval: 60 @60 sec Generate Summary @60 sec Generate Global Summary

TCP Header U A S F MASK = ASF Flags = SF 1 1

False Positive = TOO SENSITIVE False Negative = INSENSITIVE (Increase accuracy. . /cmd. exe rather than. . /) (Decrease accuracy. . / rather than. . /fred. txt/home/)