Sophos XG v18 Custom IPS signatures - multiple content values

RE: Sophos XG v18 Custom IPS signatures - multiple content values

LuCar Toni — Tue, 17 Nov 2020 10:43:28 GMT

Sure you can, see: https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/concepts/IPSCustomSignatures.html

But again, Port is not part of content.

RE: Sophos XG v18 Custom IPS signatures - multiple content values

JoelTimm — Tue, 17 Nov 2020 07:00:17 GMT

Hi Toni,

I have other IPS custom signatures and they're working without any problem. I just ask if we can put more than one "content" parameter in the custom signature as it's written in the manual and how. the fact is: IPS custom signature with 1 "content" parameter -> it works and it's written in my reports, when the xg is using my custom signature, but when the IPS custom signature with 2 or more "content" -> invalid error.

Regards,

Joel Timm

RE: Sophos XG v18 Custom IPS signatures - multiple content values

LuCar Toni — Mon, 16 Nov 2020 10:57:54 GMT

First question, not related to IPS in specific, but more likely to this rule, are you decrypting HTTPS? Because you try to scan contant within HTTPs, which is not possible without decryption.

Your rule is likely invalid, as the content part covers the packet content, and not the Port.

For example: https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/tasks/IPSCustomSignatureAdd.html

RE: Sophos XG v18 Custom IPS signatures - multiple content values

JoelTimm — Mon, 16 Nov 2020 10:43:04 GMT

Hi Ian,

could you be more accurate please?
Is there a function for to compare the rules?

Do you mean compare the custom IPS signatures?
I have used since the beginning just one content parameter for every signature.

I've tried something new because we are receiving lot of scan attempt on our IPS Software on the Machines and we are trying to block these ones directly on the Sophos XG.

Joel.

RE: Sophos XG v18 Custom IPS signatures - multiple content values

rfcat_vk — Mon, 16 Nov 2020 10:03:38 GMT

Hi,

when you compare your rule to existing rules how does the format compare?
ian