1 Reply Latest reply on May 16, 2010 7:42 PM by AlaXul

    Problems UDS not worked

      Hi,

       

      I created a UDS with the following condition initially.

       

      http-req-uri-path matches "google" (case-insensitive)

       

      just to test and see how the mechanism of creation of rules IntruShield. I created a policy and applied the interfaces 3A-3B and tested access not working after I created the following signature.

      ipv4-source-ip == 192.168.4.100{0xc0a80464](unsigned)

      Still did not work. Is there a setting more to be done?

      I'm using M-4050 and version 6.0.3.4

       

      Regards.

        • 1. Re: Problems UDS not worked

          First, you may simply wish to export your UDS and attach it here. That would make it much easier to see what you did.  Second, make sure you verify that the signature you exported back to the manager is included in your rule set for your policy.  If you have created dynamic rules in your rule set to ignore alerts below BTP or Severity thresholds, your signature may automatically be filtered out.  Also, if you set your UDS to a severity of below Medium, make sure you do not use the Real-Time alert viewer as it will auto acknowledge and will not list even if it is triggering.  Use the Historical Alert Viewer instead.

           

          Regards,