Displays rule attributes associated with IPS policies defined on an IPS-enabled Network Security appliance. The command output shows the attributes for IPS policies defined on an IPS‑enabled appliance.
This command is not supported on SmartVision Edition appliances, which are Network Security appliances with SmartVision Edition appliance licenses. The SmartVision Edition sensor is also called Trellix Network Security, SmartVision Edition.
By default, the command output displays non-match attributes for the specified IPS policy. You can include optional parameters to show match attributes or the exclusion list or inclusion list of the IPS policy. For more information, see the Network Security IPS Feature Guide.
Note
You can also run this command remotely from the command line of an integrated FireEye Central Management System appliance using the central management appliance proxying mechanism.
Syntax
show ips policies [<policyName>]
Parameters
<policyName>
Name of the IPS policy whose attributes are to be displayed.
Output fields
The following table describes the output fields for the show ips policies command. Fields are listed in the approximate order in which they appear in the output.
Field name | Field description |
|---|---|
State attributes | |
active | Indicates whether the IPS policy is active:
|
writeable | Indicates whether the IPS policy is configurable:
|
modified_date | Date and time at which the IPS policy was last modified. |
version | IPS policy format internal version number. |
Match attributes | |
attack‑target | Type of network host machine that the rule covers. |
min-severity | Attack severity level of the rule is equal to or above this lower limit. Range: 1 – 10. |
max-severity | Attack severity level of the rule is equal to or below this upper limit. Range: 1 – 10. |
category | (Option for custom IPS policies) Category of the network attack that the rule covers. |
sub_category | (Option for custom IPS policies) Subcategory of the network attack that the rule covers. |
protocol | (Option for custom IPS policies) Network protocol covered by the rule. |
Rule-exclusion and rule-inclusion attributes | |
Inclusion list | (Option for custom IPS policies) List of signature IDs of IPS rules to be explicitly included in the policy selection. |
Exclusion list | (Option for custom IPS policies) List of signature ID of IPS rules to be explicitly excluded from the policy selection. |
Fingerprint | (Custom IPS policies only) Hexadecimal string that identifies the attributes of a custom IPS policy. IPS policies have the same fingerprint if the policies share the same match attributes, rule-exclusion attributes, and rule-inclusion attributes. |
Examples
show ips policies ?
hostname # show ips policies ? <cr> Policy name> FireEye_Default Comprehensive Default_Client_Protection Default_Server_Protection myCustom1 myCustom2
show ips policies
hostname # show ips policies
FireEye_Default active : yes version : 2 Comprehensive active : no version : 2 Default_Server_Protection active : no version : 2 Default_Client_Protection active : no version : 2 myCustom1 active : no version : 1 No. of included rules: 1 No. of excluded rules: 2 myCustom2 active : no version : 1 No. of included rules: 1 No. of excluded rules: 2 myCustom3 active : no version : 1 No. of included rules: 1 No. of excluded rules: 2
show ips policies myCustom1
hostname # show ips policies myCustom1 Policy attributes : active : no writable : yes modified_date : 2014/09/25 10:24:48 version : 9 Match attributes of policy : attack-target : client min-severity : 5 max-severity : 10 Inclusion list for policy : 85301782 Exception list for policy : 8530001,8530050 Fingerprint of policy : 2014/09/25 10:24:48 | 287fd1bda05326809e195cccf5e9798c
User role
Monitor, Analyst, Operator, or Admin
Command mode
Enable
Supported appliances
This command is supported on the following appliance running the specified release or later:
Network Security: Release 7.2.0. Parameters
exclude,fingerprint,include, andrulesremoved in Release 7.5.0.