High Severity Action—Deny.

Medium Severity Action—Deny.

Low Severity Action—Alert.

High Severity Action—Deny.

Medium Severity Action—Alert.

Low Severity Action—Alert.

Specify a unique name for the Web attack signature policy and click Save. Valid characters are A-Z, a-z, 0-9, _, and -. No space is allowed between characters.

Note: Once saved, the policy name cannot be changed.

This section lists the (main) categories of Web attack signatures within the system. Do the following to include the desired categories of Web attack signature in the policy:

1. In the Name column, identify the categories of Web attack signatures of interest.
2. In the Status column, select (check mark) the categories you like to include in the policy.
3. In the Action column, select the action you want to apply to the categories that you select.
4. Double-click the name of a category to view its sub-categories. See Sub-category below.

This section lists the sub-categories of a (main) category of Web attack signature that you have opened (double-clicked) from above. Do the following to enable any of the sub-categories of interest:

1. In the Name column, identify the sub-categories of interest.
2. In the Status column, select (check mark) the sub-categories you like to include in the policy.

This dialog provides tools for searching through and filtering Web attack signatures available within the system.

Use the following options to search for Web attack signatures to display:

• Description—Enter a descriptive text string and click Search.
• ID—Enter a Web attack signature ID and click Search.
• CVE Number—Enter a CVE number related to a Web attack signature and click Search.
• Clear Search—Click this button to empty all search fields.

Note: Web attack signatures that match your search criterion show up in the Signature section below the moment you click the corresponding Search button.

Use any or a combination of the following filters to filter the Web attack signatures to be displayed in the Signature section below:

• Category—Click the down arrow and select a (main) category of Web attack signatures from the drop-down menu.
• Sub-category—Click the down arrow and select a sub-category of the category of Web attack signatures that you have selected.
• Status —Click the down arrow and select either (Enable or Disable) from the drop-down menu.
• Severity—Click the down arrow and select High, Medium, or Low from the drop-down menu.
• Exception—Click the down arrow and select either (Yes or No) from the drop-down menu.
• Clear All—Click this button to clear the existing filters. Note: You can also remove a specific filter by clicking the corresponding x mark.

This section displays all Web attack signatures that match your search and filter criteria, showing the following information for each Web attack signature:

• ID
• Status
• Name
• Severity
• Target Application
• Exception Name

This section shows detailed information about the Web attack signature that you've highlighted (clicked) in the Signature section above.

This tab shows the following information about the selected signature:

• Signature ID
• Category
• Sub-category
• Severity
• Target Application
• Description
• CVE Number (if one exists)
• Reference (if one exists)
• Found In

Generic XSS Attack (42)

Generic SQL Injection (43)

OS Command Injection (1)

Coldfusion Injection (2)

LDAP Injection (3)

Command Injection (4)

Session Fixation (5)

File Injection (6)

PHP Injection (7)

SSI Injection (8)

UPDF XSS (9)

Email Injection (10)

HTTP Response Splitting (11)

RFI Injection (12)

Xpath Injection (49)

XML External Entities (57)

Insecure Deserialization (59)

HTTP Header Injection (60)

Buffer Overflow (62)

Denial Of Service (64)

Trojans (44)

Zope Information Leakage (13)

CF Information Leakage (14)

PHP Information Leakage (15)

ISA Server Existence Revealed (16)

Microsoft Office Document Properties Leakage (17)

CF Source Code Leakage (18)

IIS Information Leakage (19)

Weblogic information leakage (20)

Generic Filename and Directory leakage (21)

ASP/JSP Source Code Leakage (22)

PHP Source Code Leakage (23)

SQL Error leakage (24)

HTTP Header Leakage (25)

WordPress Leakage (26)

Generic Malicious Leakage (47)

Path Travel (58)

Oracle 9i (27)

Coppermine Photo Gallery (28)

Netscape Enterprise Server (29)

Cisco IOS HTTP Service (30)

Microsoft SQL Server (31)

HP OpenView Network Node Manager (32)

Best Sofrware SalesLogix (33)

IBM Lotus Domino Web Server (34)

Microsoft IIS (35)

Microsoft Windows Media Services (36)

Dave Carrigan Auth_LDAP (37)

427BB (38)

RaXnet Cacti Graph (39)

CHETCPASSWD (40)

SAP (41)

Generic Exploit (48)

Lighttpd Server (53)

Caucho Resin Server (54)

JRun Web Server (55)

IBM Lotus Domino (56)

WordPress (61)

Struts 2 (63)

Joomla! (65)

Credit Card Detection (45)

Bad Robot (46)

Cross Site Scripting (Extended) (50)

SQL Injection (Extended) (51)