ips policy match

Adds, changes, or removes rule-selection match attributes on a custom IPS policy. For more information, see the Network Security IPS Feature Guide.

Note

You can also run this command remotely from the command line of an integrated Central Management System appliance using the central management appliance proxying mechanism.

Syntax

[no] ips policy<policyName>match (attack-target <hostType> | category <categoryName> [sub_category <subCategoryName>] | max-severity <maxLevel> | min-severity <minLevel> | protocol <protocolName>)

Parameters

no

Use the no form of the command to remove an attack-target, category, sub_category, or protocol match attribute from the policy.

attack-target <hostType>

(Required) Select rules for the specified type of targeted host:

category <categoryName>

(Optional) Select rules for the specified type of attack category:

sub_category <subCategoryName>

(Optional) If a category match attribute is specified, you can narrow the category match to rules that cover the specified type of attack subcategory.

brute_force subcategories:

command_execution subcategories:

cross-site_scripting subcategories:

denial_of_service subcategories:

directory_traversal subcategories:

exploit subcategories:

policy_bypass subcategories:

other subcategories:

max-severity <maxLevel>

(Required) Select rules that cover vulnerabilities of the specified severity level or lower, but not below the level specified by the min-severity

setting. Range: 1 through 10, inclusive.

min-severity <minLevel>

(Required) Select rules that cover vulnerabilities of the specified severity level or higher, but not exceeding the level specified by the max-severity

setting. Range: 1 through 10, inclusive.

protocol <protocolName>

(Option for custom policies only) Select IPS rules that cover vulnerabilities related to the specified network protocols. At the time of this software release, IPS rules detect threats that exploit the following protocols: ABB products, AgentX, Arkeia Network Backup Client, Autonomy Connected Backup, Avaya WinPDM, BakBone NetVault, BigAnt Server, Blue Coat BCAAA, CA ARCserve, CA eTrust, CA License, CA Products, CA Products Discovery Service, Cisco UCM, Citrix, CUPS, CVS, DCE‑RPC, DHCP, Digium Asterisk, DNS, EMC, eSignal, Ethereal, Flexera FlexNet manager, FTP, Fujitsu SystemcastWizard, GAIM, Ganglia Meta Daemon, GDS DB, GE Proficy, GIMP, GIOP, HP Data Protector, HP Intelligent Mgmt Center, HP LeftHand Virtual SAN, HP Mercury, HP OpenView, HP Operations Agent, HP StorageWorks, HTTP, http, IAX2, IBM DB2, IBM Director, IBM SolidDB, IBM Tivoli, ICQ, IEC 61131, IMAP, Intellicom NetBiter Config, IPSwitch WS_FTP, IRC, ISAKMP, iSCSI, KADM5, Kerberos, KPASSWD, LANDesk Management Suite, LDAP, LLMNR, LPD, McAfee ePO, Microsoft TMG, MMS, MS Host Integration Server, MSN Messenger, NCP, NDMP, NetBIOS, NFS, NMAP, NNTP, Novell Netware, Novell ZENworks, NTP, Oracle WebLogic, POP3, Portmap, Quest Software Big Brother, RADIUS, RAW, RDP, RIM BlackBerry Server, RMI, RPC, RSH, RTMP, RTSP, sadmind, SADMIND, SAP MaxDB, SAP NetWeaver, SCADA, Siemens SIMATIC WinCC, SIP, SKINNY, SMS, SMTP, SNMP, SOCKS, SpamAssassin, SQL, Squid Proxy, SSH, Symantec, TDS, Telnet, TFTP, Timbuktu, TLS, TNS, TrendMicro, Trillian IM, Unisys BIS, VMware, VNC, WCCP, WHO, WINS, Yahoo Messenger, and Zend Technologies Zend Server.

For protocols that use encryption, the IPS-enabled rules engine inspects the initial negotiation messages only.

Note

This list is dynamic and subject to expansion as Trellix discovers new vulnerabilities and responds by updating threat detection algorithms and delivering new IPS rules.

Examples

ips policy myCustom1 match ?

hostname (config) # ips policy myCustom1 match ?
attack-target        Add attack target for policy
category             Add match criteria for a policy
max-severity         Add max severity for policy
min-severity         Add min severity for policy
protocol             Add protocol for policyxxx

ips policy myCustom1 match (New Policy)

hostname (config) # ips policy myCustom1
hostname (config) # ips policy myCustom1 match category denial_of_service
hostname (config) # ips policy myCustom1 match category exploit sub_category code_execution
hostname (config) # ips policy myCustom1 match protocol dhcp
hostname (config) # ips policy myCustom1 match protocol http
hostname (config) # ips policy myCustom1 match min-severity 8

hostname (config) # show ips policies myCustom1 match
        category : denial_of_service
        category : exploit
        sub_category : code_execution
        protocol : dhcp
        protocol : http
        attack-target : client
        attack-target : server
        min-severity : 1
        max-severity : 10

no ips policy myCustom1 match category denial_of_service (Inactive Policy)

hostname (config) # no ips policy myCustom1 match category denial_of_service

no ips policy myCustom2 match category denial_of_service (Active Policy)

hostname (config) # no ips policy myCustom2 match category denial_of_service
% Policy is not writable

no ips policy myCustom2 match category denial_of_service (Inactive Policy)

hostname (config) # no ips policy myCustom2 interface B
hostname (config) # no ips policy myCustom2 match category denial_of_service

User role

Operator or Admin

Command mode

Config

Supported appliances

This command is supported on the following appliances running the specified releases or later: