IPS signature filter options

IPS signature filter options include hold time and CVE pattern.

Hold time

The hold time option allows you to set the amount of time that signatures are held after a FortiGuard IPS signature update per VDOM. During the holding period, the signature's mode is monitor. The new signatures are enabled after the hold time to avoid false positives.

The hold time can be from 0 days and 0 hours (default) up to 7 days, in the format ##d##h.

To configure the amount of time to hold and monitor IPS signatures:
config system ips
    set signature-hold-time 3d12h
    set override-signature-hold-by-id enable

When a signature that is on hold is matched, the log will include the message signature is on hold:

date=2010-07-06 time=00:00:57 logid="0419016384" type="utm" subtype="ips" eventtype="signature" level="alert" vd="vd1" eventtime=1278399657778481842 tz="-0700" severity="info" srcip= srccountry="Reserved" dstip= srcintf="port13" srcintfrole="undefined" dstintf="port14" dstintfrole="undefined" sessionid=3620 action="detected" proto=6 service="HTTP" policyid=1 attack="Eicar.Virus.Test.File" srcport=52170 dstport=80 hostname="" url="/virus/eicar" direction="incoming" attackid=29844 profile="test" ref="http://www.fortinet.com/ids/VID29844" incidentserialno=25165825 msg="file_transfer: Eicar.Virus.Test.File, (signature is on hold)"
To view signatures being held by rule ID 29844 on the VDOM:
# diagnose ips signature on-hold vd1 29844
Rule: 29844, attack_id: 58886, last updated: 20170411
Rule: 29844, attack_id: 59517, last updated: 20170411
Rule: 29844, attack_id: 60105, last updated: 20170411
To view all help signatures on the VDOM:
# diagnose ips signature on-hold vd1
Rule: 17541, attack_id: 20899, last updated: 20140423
Rule: 17557, attack_id: 20934, last updated: 20140423
Rule: 17559, attack_id: 20932, last updated: 20140423
Rule: 17560, attack_id: 20933, last updated: 20140423
Rule: 17562, attack_id: 20928, last updated: 20170908
Rule: 17677, attack_id: 21187, last updated: 20171106
Rule: 17713, attack_id: 43756, last updated: 20140424
Rule: 17759, attack_id: 21298, last updated: 20140423

Viewing on hold information in the GUI

On hold signatures are grayed out in the GUI with an hourglass icon beside the signature name. A tooltip displays the on hold expiry time and other details.

On the Security Profiles > IPS Signatures page, for example, the Adobe.Reader.Annots.api.setProps.Use.After.Free signature is on hold. Hover over the grayed-out entry to view the tooltip, which includes the action and hold time expiry. On this page, all on hold signatures are displayed as on hold regardless of whether override-signature-hold-by-id is enabled.

The same tooltip is available on the Edit IPS Sensor (Security Profiles > Intrusion Prevention) page when creating or editing the IPS signatures. In the Add Signatures pane when the Type is Signature, signatures on hold are only displayed as on hold if override-signature-hold-by-id is enabled.