Create IPS Signature Dynamic Group

Name must be a string beginning with a letter or underscore and consisting of letters, numbers, dashes and underscores; 250-character maximum.

Filter Criteria

Select one or more values from the list for the attack name prefix match.

Select one or more severity values from the list to add attack objects based on the attack severity levels (critical, info, major, minor, or warning).

• Critical—The attack is a critical one.

• Info—Provides information of attack when it matches.

• Major—The attack is a major one.

• Minor—The attack is a minor one.

• Warning—Issues a warning when attack matches.

Select one or more service values from the list to add attack objects based on the attack service. For example, BGP, FTP, and HTTP.

Select one or more category values from the list to add attack objects based on the category.

Select one of the following filter:

• None—No action is performed.

• Yes—The recommended filter to add predefined attacks recommended by Juniper Networks to the dynamic attack group.

• No—The non-recommended attack objects in the dynamic attack group.

Select one or more direction values from the list:

• Any—Monitors traffic from client to server and server to client.

• Client to Server—Monitors traffic only from client to server (most attacks occur over client to server connections).

• Exclude Any—Allows traffic from client to server and server to client.

• Exclude Client to Server—Allows traffic only from server to client.

• Exclude Server to Client—Allows traffic only from client to server.

• Server to Client—Monitors traffic only from server to client.

Select one of the following expressions from the list:

• None—No action is performed.

• AND—If both the directions match, the expression matches.

• OR—If either of the directions match, the expression matches.

Select one or more performance values from the list:

• Fast—Fast track performance level.

• Normal—Normal track performance level.

• Slow—Slow track performance level.

• Unknown—By default, all compound attack objects are set to Unknown. As you fine-tune IPS to your network traffic, you can change this setting to help you track performance level.

Select one or more false positives value from the list:

• Frequently—Frequently track false positive occurrences.

• Occasionally—Occasionally track false positive occurrences.

• Rarely—Rarely track false positive occurrences.

• Unknown—By default, all compound attack objects are set to Unknown. As you fine-tune IPS to your network traffic, you can change this setting to help you track false positives.

Select Anomaly or Signature attack type from the list. If you choose None, no action will be taken.

Select Excluded or Not Excluded from the list to check the signatures that are part of the database updates. If you choose None, no action will be taken.

Select Greater than or Less than from the list to specify the Common Vulnerability Scoring System (CVSS) score of the attack.

CVSS score of the attack is a free and open industry standard for assessing the severity of computer system security vulnerabilities. CVSS attempts to assign severity scores to vulnerabilities allowing responders to prioritize responses and resources according to threats.

Set to match the CVSS score greater than the value specified.

Range: 0 through 10

Set to match the CVSS score lesser than the value specified.

Range: 0 through 10

Select Greater than or Less than from the list to specify the age of the attack.

Set to match when age of attack in terms of years is greater than or less than the specified value (years).

Range: 1 through 100.

Select the file type from the list that the attack targets. For example, HTML and PDF.

Select the vulnerability type for IPS from the list that indicates which applications are weak and can be manipulated. The vulnerability type is reported for fixing these vulnerabilities.