Create an IPS Signature Dynamic Group

The signature database in Juniper Security Director Cloud contains predefined intrusion prevention system (IPS) signature dynamic groups.

You can create customized IPS signature dynamic groups based on a specific filter criteria from the Create IPS Signature Dynamic Group page. You must have the tenant administrator role or a custom role with the appropriate IPS tasks to create customized IPS signature dynamic groups.

The specified filter criteria are matched only to predefined or customized IPS signatures, and not to IPS static groups and dynamic groups. When a new signature database is used, the dynamic group membership is automatically updated based on the filter criteria for the group.

To create a customized IPS signature dynamic group:

Select SRX > Security Subscriptions > IPS > IPS Signatures.

The IPS Signatures page opens.
Select Create > Dynamic Group.

The Create IPS Signature Dynamic Group page opens.
Complete the configuration according to the guidelines in Table 1.
(Optional) Click Preview Filtered Signatures to check whether the signatures that match the dynamic group are consistent with the specified filter criteria.

The IPS Signatures page opens displaying the list of IPS signatures matching the filters.

If the signatures do not match, you can tweak the filter criteria. Click Close to go back to the previous page.

Click OK.

The IPS Signatures page opens with a message indicating that the dynamic group was successfully created.

You can use the new IPS signature dynamic group in an IPS rule or an exempt rule. You can then reference the IPS profile containing the rule in a firewall policy, which you can deploy on the device.

Table 1: Create IPS Signature Dynamic Group Settings
Setting	Guideline
Name	Enter a unique name for the IPS signature dynamic group that is a string of maximum 255 characters without spaces. The string can contain alphanumeric characters and special characters, such as colons, hyphens, periods, and underscores.
Filter Criteria	Select one or more filters to define the attributes of IPS signatures that will be added to the new IPS signature dynamic group. Filters apply to existing signatures (already downloaded in the application) and to new signatures when the signatures are downloaded. IPS signatures that match any of the configured filters are included as part of the signature group.
Severity
Info	Enable this option to include IPS signatures with the Info severity level.
Warning	Enable this option to include IPS signatures with the Warning severity level.
Minor	Enable this option to include IPS signatures with the Minor severity level.
Major	Enable this option to include IPS signatures with the Major severity level.
Critical	Enable this option to include IPS signatures with the Critical severity level.
Service
Service	Select the services to filter IPS signatures that must be included as part of the dynamic group. Select one or more services listed in the Available column, and click the forward arrow to confirm your selection. The selected services are displayed in the Selected column.
Category
Category	Select the categories to filter IPS signatures that must be included as part of the dynamic group. Select one or more categories listed in the Available column, and click the forward arrow to confirm your selection. The selected categories are displayed in the Selected column.
Recommended
Recommended	This filter is based on attack objects that are recommended by Juniper Networks. Select one of the following: None—Do not use this filter. Yes—Add predefined attacks recommended by Juniper Networks to the dynamic group. No—Add predefined attacks that are not recommended by Juniper Networks to the dynamic group.
Direction	Add IPS signatures to the dynamic group based on the traffic direction of the attacks. If you select more than one traffic direction (Any, Client-to-Server, and Server-to-Client), you must select a value in the Expression field.
Any	Select one of the following: None (default): Do not use this filter. Yes: Include IPS signatures that track traffic from client to server or server to client. No: Do not include IPS signatures that track traffic from client to server or server to client.
Client-to-Server	Select one of the following: None (default): Do not use this filter. Yes: Include IPS signatures that track traffic from client to server. No: Do not include IPS signatures that track traffic from client to server.
Server-to-Client	Select one of the following:. None (default): Do not use this filter. Yes: Include IPS signatures that track traffic from server to client. No: Do not include IPS signatures that track traffic from server to client.
Expression	If you select more than one traffic directional filter, you must select how the signatures must be matched: None (default): Do not use this filter. OR—Include signatures that match any of the specified traffic directions. AND—Include signatures that match all of the specified traffic directions.
Performance Impact
Unknown	Enable this option to include the IPS signatures with the Unknown performance impact.
Slow	Enable this option to include the IPS signatures with the Slow performance impact.
Normal	Enable this option to include the IPS signatures with the Normal performance impact.
Fast	Enable this option to include the IPS signatures with the Fast performance impact.
False Positives
Unknown	Enable this option to include the IPS signatures with the Unknown match assurance.
Low	Enable this option to include the IPS signatures with the Low match assurance.
Medium	Enable this option to include the IPS signatures with the Medium match assurance.
High	Enable this option to include the IPS signatures with the High match assurance.
Age of Attack	The age of the attack in years to be used as a filter criteria to include IPS signatures as part of the dynamic group.
Greater Than	Enter the age of attack in years to include the IPS signatures with the age of attack greater than the specified value as part of the dynamic group. The range is from 1 to 100 years.
Less Than	Enter the age of attack in years to include the IPS signatures with the age of attack less than the specified value as part of the dynamic group. The range is from 1 to 100 years.
CVSS Score	The Common Vulnerability Scoring System (CVSS) to be used as a filter criteria to include IPS signatures as part of the dynamic group.
Greater Than	Enter the CVSS score to include the IPS signatures with the score greater than the specified value as part of the dynamic group. The range is a decimal number between 0 and 10.
Less Than	Enter the CVSS score to include the IPS signatures with the score less than the specified value as part of the dynamic group. The range is a decimal number between 0 and 10.
Other Filters
Excluded	Select one of the following:. None (default): Do not use this filter. Yes: Include excluded attack objects as part of the dynamic group. No: Do not include excluded attack objects as part of the dynamic group.
File Type	Select the file type of the attack to be used as a filter criteria. For example, flash.
Vulnerability Type	Select the vulnerability type of the attack to be used as a filter criteria. For example, overflow.
Type	Use this filter to group attack objects by type (anomaly or signature).
Signature	Enable this option to add signatures based on stateful signature attack objects specified in the signature. A stateful attack signature is a pattern that always exists within a specific section of the attack. Stateful signature attack objects also include the protocol or service used to perpetrate the attack and the context in which the attack occurs.
Protocol Anomaly	Enable this option to add signatures of attacks that violate protocol specifications (RFCs and common RFC extensions).
Vendor Description
Product Type	Select this filter to include signatures belonging to the selected product type.
Vendor Name	Select this filter to include signatures belonging to the selected vendor.
Title	Select this filter to include signatures belonging to the selected product name. The product names are populated only when you select a product type and a vendor.