cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

Create a filter for an application with multiple signatures?

Jump to solution

Hello,

I'm wondering if there is an easy way to filter out events where the "Application" field is the same, but where different Signature IDs are involved. 

We have some VmWare ESX servers which are VERY chatty.  All of the events coming in with the application "vxpa" are not useful from a security perspective.  I could disable the ASP rules one by one, but there are a lot of them involved. 

Any help is apperciated!

Thanks,

- Steve

1 Solution

Accepted Solutions
Reliable Contributor akerr
Reliable Contributor
Report Inappropriate Content
Message 4 of 5

Re: Create a filter for an application with multiple signatures?

Jump to solution

Content strings are just a very simple string match, rather than regex.  So it should work, but I'd be hesitant to base it on such a short string.

4 Replies
Reliable Contributor akerr
Reliable Contributor
Report Inappropriate Content
Message 2 of 5

Re: Create a filter for an application with multiple signatures?

Jump to solution

You absolutely can write filters, but they happen before the parsers, so you'll have to do it with regex.  

In the Policy Editor, Expand Receivers and click Filters.  You can add a new filter there.  I'd suggest only enabling it on the data sources you want it to apply to however, rather than globally.

Re: Create a filter for an application with multiple signatures?

Jump to solution

Hi akerr,

Thanks for the response.  I do know about the filters, and have written a bunch.  However, for each of these different signatures that are involved, I'd need to write a different Regex, which will be a lot of work.  That's why I was looking for an easier solution. 

The other part of the filter rules (besides PCRE) is "Content Strings."  I thought that if I put "vpxa" as a content string and made it case-insensitive, that would do the trick.  Certainly "vpxa" is a string that is in these packets.  However, it doesn't seem to work.  Is there a particular format for content strings?

Thanks,

- Steve

Reliable Contributor akerr
Reliable Contributor
Report Inappropriate Content
Message 4 of 5

Re: Create a filter for an application with multiple signatures?

Jump to solution

Content strings are just a very simple string match, rather than regex.  So it should work, but I'd be hesitant to base it on such a short string.

Re: Create a filter for an application with multiple signatures?

Jump to solution
Thank you! I created the filter and it seems to be working (I'm not sure what I did wrong with the content string the first time.) I'll play with it and make sure that it's not "too" effective.
MPower Badge Now Available
Customers attending MPower can earn a community badge. Check into the MPower forum and say hi to have the badge awarded to your community profile.