config ips custom
Use this command to create or modify custom Intrusion Prevention System (IPS) signatures on a FortiNDR device. This command allows you to define detection patterns, assign severity levels, add comments, and enable or disable the signature as needed.
Sytnax
config ips custom
edit <tag>
set comment {string}
set severity [low | medium | high | critical]
set signature <var-string>
set status [disable | enable]
next
end
|
Variable |
Description |
Default |
|---|---|---|
|
comment |
Enter additional context or notes about the custom IPS signature.. |
|
|
severity |
Relative severity of the signature, from low to critical. Log messages generated by the signature include the severity. |
Enabled |
|
status |
Enable/disable this signature. |
Enabled |
|
signature |
Custom signature enclosed in single quotes. NOTE: To modify the name of a signature, you must update the value using the |
Maximum length: 4095 |
|
tag |
Signature tag. |
Maximum length: 63 |