Fortinet white logo
Fortinet white logo

CLI reference

config ips custom

config ips custom

Use this command to create or modify custom Intrusion Prevention System (IPS) signatures on a FortiNDR device. This command allows you to define detection patterns, assign severity levels, add comments, and enable or disable the signature as needed.

Sytnax

config ips custom
    edit <tag>
        set comment {string}
        set severity [low | medium | high | critical]
        set signature <var-string>
        set status [disable | enable]
    next
end

Variable

Description

Default

comment

Enter additional context or notes about the custom IPS signature..

severity

Relative severity of the signature, from low to critical. Log messages generated by the signature include the severity.

Enabled

status

Enable/disable this signature.

Enabled

signature

Custom signature enclosed in single quotes.

NOTE: To modify the name of a signature, you must update the value using the --name keyword in the signature command. The set name field is read-only and cannot be changed directly.

Maximum length: 4095

tag

Signature tag.

Maximum length: 63

config ips custom

config ips custom

Use this command to create or modify custom Intrusion Prevention System (IPS) signatures on a FortiNDR device. This command allows you to define detection patterns, assign severity levels, add comments, and enable or disable the signature as needed.

Sytnax

config ips custom
    edit <tag>
        set comment {string}
        set severity [low | medium | high | critical]
        set signature <var-string>
        set status [disable | enable]
    next
end

Variable

Description

Default

comment

Enter additional context or notes about the custom IPS signature..

severity

Relative severity of the signature, from low to critical. Log messages generated by the signature include the severity.

Enabled

status

Enable/disable this signature.

Enabled

signature

Custom signature enclosed in single quotes.

NOTE: To modify the name of a signature, you must update the value using the --name keyword in the signature command. The set name field is read-only and cannot be changed directly.

Maximum length: 4095

tag

Signature tag.

Maximum length: 63