IPS signature filter options

IPS signature filter options include hold time, CVE pattern, and IPS sensor attributes.

Hold time

The hold time option allows you to set the amount of time that signatures are held after a FortiGuard IPS signature update per VDOM. During the holding period, the signature's mode is monitor. The new signatures are enabled after the hold time to avoid false positives.

The hold time can be from 0 days and 0 hours (default) up to 7 days, in the format ##d##h.

To configure the amount of time to hold and monitor IPS signatures:

config system ips
    set signature-hold-time 3d12h
    set override-signature-hold-by-id enable
end

When a signature that is on hold is matched, the log will include the message signature is on hold:

date=2010-07-06 time=00:00:57 logid="0419016384" type="utm" subtype="ips" eventtype="signature" level="alert" vd="vd1" eventtime=1278399657778481842 tz="-0700" severity="info" srcip=10.1.100.22 srccountry="Reserved" dstip=172.16.200.55 srcintf="port13" srcintfrole="undefined" dstintf="port14" dstintfrole="undefined" sessionid=3620 action="detected" proto=6 service="HTTP" policyid=1 attack="Eicar.Virus.Test.File" srcport=52170 dstport=80 hostname="172.16.200.55" url="/virus/eicar" direction="incoming" attackid=29844 profile="test" ref="http://www.fortinet.com/ids/VID29844" incidentserialno=25165825 msg="file_transfer: Eicar.Virus.Test.File, (signature is on hold)"

To view signatures being held by rule ID 29844 on the VDOM:

# diagnose ips signature on-hold vd1 29844
Rule: 29844, attack_id: 58886, last updated: 20170411
Rule: 29844, attack_id: 59517, last updated: 20170411
Rule: 29844, attack_id: 60105, last updated: 20170411
...

To view all help signatures on the VDOM:

# diagnose ips signature on-hold vd1
Rule: 17541, attack_id: 20899, last updated: 20140423
Rule: 17557, attack_id: 20934, last updated: 20140423
Rule: 17559, attack_id: 20932, last updated: 20140423
Rule: 17560, attack_id: 20933, last updated: 20140423
Rule: 17562, attack_id: 20928, last updated: 20170908
Rule: 17677, attack_id: 21187, last updated: 20171106
Rule: 17713, attack_id: 43756, last updated: 20140424
Rule: 17759, attack_id: 21298, last updated: 20140423
...

Viewing on hold information in the GUI

On hold signatures are grayed out in the GUI with an hourglass icon beside the signature name. A tooltip displays the on hold expiry time and other details.

On the Security Profiles > IPS Signatures page, for example, the Adobe.Reader.Annots.api.setProps.Use.After.Free signature is on hold. Hover over the grayed-out entry to view the tooltip, which includes the action and hold time expiry. On this page, all on hold signatures are displayed as on hold regardless of whether override-signature-hold-by-id is enabled.

The same tooltip is available on the Edit IPS Sensor (Security Profiles > Intrusion Prevention) page when creating or editing the IPS signatures. In the Add Signatures pane when the Type is Signature, signatures on hold are only displayed as on hold if override-signature-hold-by-id is enabled.

You can still use on hold signatures in an IPS sensor profile; however, the profile will not block matching traffic. It will monitor it instead (logging in effect) until the on hold time expires.

CVE pattern

The CVE pattern option allows you to filter IPS signatures based on CVE IDs or with a CVE wildcard, ensuring that any signatures tagged with that CVE are automatically included.

To configure CVE patterns for CVE-2010-0177 and all CVE-2017 CVEs:

config ips sensor
    edit "cve"
        set comment "cve"
        config entries
            edit 1
                set cve "cve-2010-0177"
                set status enable
                set log-packet enable
                set action block
            next
            edit 2
                set cve "cve-2017"
                set action reset
            next
        end
    next
end

For example, the CVE of the IPS signature Mozilla.Firefox.PluginArray.NsMimeType.Code.Execution is CVE-2010-0177. This matches the CVE filter in the IPS sensor, so traffic is blocked and logged:

date=2020-07-13 time=15:44:56 logid="0419016384" type="utm" subtype="ips" eventtype="signature" level="alert" vd="vd1" eventtime=1594593896666145871 tz="-0700" severity="critical" srcip=10.1.100.22 srccountry="Reserved" dstip=172.16.200.55 srcintf="port2" srcintfrole="undefined" dstintf="port1" dstintfrole="undefined" sessionid=1638 action="dropped" proto=6 service="HTTPS" policyid=1 attack="Mozilla.Firefox.PluginArray.NsMimeType.Code.Execution" srcport=58298 dstport=443 hostname="172.16.200.55" url="/Mozilla" direction="incoming" attackid=20853 profile="sensor-1" ref="http://www.fortinet.com/ids/VID20853" incidentserialno=124780667 msg="web_client: Mozilla.Firefox.PluginArray.NsMimeType.Code.Execution," crscore=50 craction=4096 crlevel="critical"

IPS sensor attributes

When configuring IPS sensor profiles, IPS signatures can be filtered based on the attributes: default status, default action, vulnerability type, and the last update date. When monitoring the specific, filtered signatures, logs are not generated for other, irrelevant signatures.

This avoids generating a lot of false positives due to many signatures having the pass action, which is never logged.

To configure filters in an IPS sensor profile:

config ips sensor
    edit "test_default"
        config entries
            edit 1
                set default-action pass
                set default-status enable
                set vuln-type 12
                set last-modified before 2020/02/02
            next
        end
    next
end

default-action {pass | block | all}	Filter by signatures' default actions (default = all).
default-status {enable | disable | all}	Filter by signatures' default statuses (default = all).
vuln-type <integer> ... <integer>	Filter by signatures' vulnerability types.
last-modified {before | after | between} <date> [end-date]	Filter by signatures' last modified date (default = before 00/00/00). The date format is yyyy/mm/dd. The year range is 2001 - 2050.

When the IPS profile is used in a firewall profile and then the EICAR virus test file signature is triggered, the signature matches the values set in the filter and logs are generated:

1:date=2022-02-15 time=14:07:03 eventtime=1644962823303491048 tz="-0800" logid="0419016384" type="utm" subtype="ips" eventtype="signature" level="alert" vd="vd1" severity="info" srcip=10.1.100.11 srccountry="Reserved" dstip=172.16.200.55 dstcountry="Reserved" srcintf="port38" srcintfrole="undefined" dstintf="port37" dstintfrole="undefined" sessionid=1171 action="detected" proto=6 service="HTTP" policyid=1 poluuid="623d2d28-8ea7-51ec-00ef-7549685a77c2" policytype="policy" attack="Eicar.Virus.Test.File" srcport=47230 dstport=80 hostname="172.16.200.55" url="/virus/eicar" direction="incoming" attackid=29844 profile="test_default" ref="http://www.fortinet.com/ids/VID29844" incidentserialno=103809025 msg="file_transfer: Eicar.Virus.Test.File"

# get ips rule status | grep Eicar.Virus.Test.File -A 18
rule-name: "Eicar.Virus.Test.File"
rule-id: 29844
rev: 10.111
date: 1491926400
action: pass
status: enable
log: disable
log-packet: disable
severity: 0.info
service: TCP, HTTP, FTP, SMTP, POP3, IMAP, NNTP
location: server, client
os: All
application: Other
rate-count: 0
rate-duration: 0
rate-track: none
rate-mode: continuous
vuln_type: Anomaly