Updating predefined IPS signatures
The FortiGuard Service periodically updates the predefined signatures and adds new signatures to counter emerging threats as they appear.
To ensure that your system is providing the most protection available, these updates can be scheduled as often as on an hourly basis. To configure this feature, go to System > FortiGuard. Under AntiVirus & IPS Updates, enable Scheduled Updates. From here you can set the updates to occur on a consistent weekly, daily, or even hourly basis.
Because the signatures included in filters are defined by specifying signature attributes, new signatures matching existing filter specifications will automatically be included in those filters. For example, if you have a filter that includes all signatures for the Windows operating system, your filter will automatically incorporate new Windows signatures as they are added.
Viewing and searching predefined IPS signatures
Go to Security Profiles > Intrusion Prevention. Select [View IPS Signatures] to view the list of existing IPS signatures. You may find signatures by paging manually through the list, apply filters, or by using the search field.
IPS processing in an HA cluster
Searching manually
Signatures are displayed in a paged list, with 50 signatures per page. The bottom of the screen shows the current page and the total number of pages. You can enter a page number and press enter, to skip directly to that page. Previous Page and Next Page buttons move you through the list, one page at a time. The First Page and Last Page button take you to the beginning or end of the list.
Searching CVE-IDs
A CVE-ID column displaying CVE-IDs can be optionally added to the IPS Signatures list, however the column is only available if the IPS package contains CVE-IDs for signatures. CVE-IDs can be numerically filtered by selecting the CVE-ID column’s arrows.
Applying filters
You can enter criteria for one of more columns, and only the signatures matching all the conditions you specify will be listed.
To apply filters
- Go to Security Profiles > Intrusion Prevention. Select [View IPS Signatures] .
- Select column by which to filter.
- Select the funnel/filter icon and enter the value or values to filter by.
- Use additional columns as needed to refine search.
The available options vary by column. For example, Enable allows you to choose between two options, while OS has multiple options, and you may select multiple items together. Filtering by name allows you to enter a text string and all signature names containing the string will be displayed.