This command was deprecated in Network Security release 9.0.2. Use the following command instead:
show policymgr signatures
Displays the overrides about disabled or forced blocking or suppression applied to vulnerabilities or IPS rules active on the appliance monitoring interfaces.
This command is not supported on SmartVision Edition appliances, which are Network Security appliances with SmartVision Edition licenses. The SmartVision Edition sensor is also called Trellix Network Security, SmartVision Edition.
For information about disabled or forced blocking or suppression applied to vulnerabilities or IPS rules, refer to the Network Security IPS Feature Guide. For information about disabled or forced blocking for all rules activated on the appliance, refer to the Network Security IPS Feature Guide.
Note
You can also run this command remotely from the command line of an integrated TrellixCentral Management System appliance using the central management appliance proxying mechanism.
Syntax
show ips signatures
Parameters
None
Output fields
The following table describes the output fields for the command. Fields are listed in the approximate order in which they appear in the output.
Field name | Description |
|---|---|
SIGNATURE | Signature for an event that is eligible for inline blocking. Can be either of the following:
|
INTF | Name of the appliance monitoring interface. |
VICTIM IP | IP address of the victim (destination). |
ATTACKER IP | IP address of the attacker (source). |
ACTION | Type of action that was taken. The action indicates whether the signature blocks, allows, or suppresses matched traffic on the specified interface. |
Examples
The following example displays the parameters when there are no blocked or suppressed vulnerabilities or rules from a particular IP address:
hostname # show ips signatures
ACTION TABLE
SIGNATURE INTF VICTIM IP ATTACKER IP
ACTION
The following example displays the parameters that you configured to disable or force blocking on a vulnerability or an individual IPS rule on an interface from a particular IP address:
hostname # show ips signatures
ACTION TABLE
SIGNATURE INTF VICTIM IP ATTACKER IP
ACTION
85305159 ALL 105.35.227.216/32 137.163.95.91/32
block
Trojan.Ramnit Inf Pg Dnload ALL 105.35.227.216/32 137.163.95.91/32
block
The following example displays blocked or suppressed vulnerabilities or rules from a particular IP address:
hostname # show ips signatures
ACTION TABLE
SIGNATURE INTF VICTIM IP ATTACKER IP
ACTION
85305159 ALL 107.182.166.198/32 183.244.186.168/32 suppress
MS XML CoreSvcs UninitObjAcc ALL 239.244.150.249/32 103.244.26.221/32
block
Trojan.Ramnit Inf Pg Dnload ALL 107.182.166.198/32 183.244.186.168/32 suppress
User role
Monitor, Operator, or Admin
Command mode
Enable
Supported appliances
This command is supported on the following appliance running the specified release or later:
Network Security: Release: 7.7. This command was deprecated in Release 9.0.2.