--- title: "Configure IPS Modification policies" canonical: "https://docs.aryaka.com/space/KNOW/237109271/Configure%20IPS%20Modification%20policies" format: markdown --- The IPS Modification Policies page allows you to create policies to enable, disable, or change the verdict for one or more signatures included in the signature feed that the intrusion prevention system (IPS) engines use when inspecting your site's traffic. IPS signature modification A signature is a specific pattern that defines malicious activity or was attributed to a previous security attack. Aryaka’s IPS uses three collections of signatures (basic, moderate, and advanced) that are updated daily by  Proofpoint  to monitor network traffic and identify any patterns that indicate a potential security threat. Aryaka modifies these signature collections so that they can be used by the three IPS security engines (LAN-Side Basic IPS, WAN-Side Basic IPS, and Advanced IPS). The resulting nine signature collections are referred to as signature  feeds  and they are displayed in a table on the  IPS Feeds  page. By default, each IPS security engine uses the basic signature feed. To change the signature feed for an IPS security engine, you must create a Signature template and apply it to one or more sites. Within the IPS feeds, each signature is assigned a status, which determines whether it is enabled or disabled, and a verdict, which recommends whether to permit or deny the traffic. When a signature is enabled, its signature verdict is used to determine whether to permit or deny matched traffic based on your configured IPS rules. When a signature is disabled, the signature is ignored by the IPS security engines. The statuses and verdicts for individual signatures are displayed on the  IPS Feeds  page. If you want to change the status or verdict of the signatures, you can create an IPS Modification policy. For example, if you want to exclude a specific signature or a category of signatures from the feed that one of the IPS engines is using to inspect your traffic, you can create an IPS Modification policy with the signature or signature category you want to exclude as a match criteria. You can then apply these policies to your IPS Signature templates and apply those templates to your sites. Follow the procedures later in this topic to add or edit IPS Modification policies.  Use cases The following are the two primary use cases for IPS Modification policies: Change a signature's status.  A signature's status determines whether its verdict is applied to security rule matches. IPS Modification policies allow you to enable or disable signatures according to the needs of your organization. Change a signature's verdict.  A signature's verdict is based on the type and severity of the threat that the signature is indicative of and it determines whether traffic is permitted or dropped. IPS Modification policies allow you to change a signature's verdict according to the needs of your organization. Policy examples The following two scenarios provide examples of IPS Modification policies.  The policies included in these example are for instructional purposes only. You should configure your IPS Modification policies based on your organization's needs. Scenario 1: Generic port scanning with Nmap Nmap is a common port scanning tool that is used to identify open ports on remote IPs. Port scanning is not, by definition, an intrusion, and Nmap can be used for internal monitoring and vulnerability testing. As displayed in the following graphic, Nmap-associated signatures are part of the classtype attempted-recon and have a verdict of  drop . If you want to use Nmap for port scanning, you need to either ensure the traffic bypasses inspection by the IPS engines ( configure IPS rules to match this type of traffic and apply the Skip IPS action), ensure the traffic is permitted by the IPS engines ( configure IPS rules to match this type of traffic and apply the Log Only  action), or modify the Nmap-associated signatures by creating an IPS Modification policy, as show in the following graphic: This policy is configured to match any traffic with a signature ID (SID) of 2009582, 2009583, 2009584, or 2101228 and apply the verdict Alert to the traffic. The recommended action associated with this verdict is to permit the traffic and generate an IPS event log. This verdict is ultimately used by your IPS security rules to determine whether to permit or deny the traffic. To apply this policy to traffic at your sites, you must associate it with an IPS Signature template. To create a Signature template, see the Configure IPS Signature templates help topic. In this scenario, using the signature classtype as the match criteria to create a policy that would permit signatures with the attempted-recon classtype is not recommended as this classtype also includes non-Nmap signatures that your organization may not want to permit.  Scenario 2: Reject signatures with Minor severity level A signature's severity (Critical, Major, Minor, or Informational) represents the potential impact of the detected intrusion. Signatures with a severity of Critical generally have a verdict of Drop or Reject while signatures with a severity of Minor have a verdict of Alert,  as shown in the following graphic. The recommendation for traffic that matches a signature with a verdict of Alert is to permit the traffic, but it is also flagged as suspicious and an IPS event log is generated. However, if you want to ensure that any traffic that matches a signature with a severity of Minor  is denied, you can modify the signature verdicts by creating an IPS Modification policy. The IPS Modification policy (Policy 2) displayed in the following graphic is configured to assign a verdict of Reject to any signatures with a signature severity of Minor : However, if there was a specific signature with a severity of Minor that you want to ensure is not rejected, you could create an additional IPS Modification policy for that specific signature. For example, consider the signature with an SID of 2023456 in the previous graphic. Policy 2 changed the verdict of the signature to Reject . If you wanted to change it back to Alert , while leaving all other signatures with a severity of Minor as Reject , you could configure the policy (Policy 3) shown in the following graphic: By configuring these two policies, and applying them to the same IPS Signature template, the verdict for the signature with the SID of 2023456 is Alert while the verdict for all other signatures with a Minor severity level is Reject . To achieve the desired result, Policy 3  must appear after Policy 2 in the Policy List for the IPS Signature template that these polices are associated with. IPS Modification policies are all evaluated in the order in which they are listed. Therefore, if Policy 2 was listed after Policy 3, Policy 3 would keep the verdict of Signature 2023456 as  Alert  but then Policy 2 would change its verdict to Reject . To add an IPS Modification policy Log in to MyAryaka. The Home page appears. Click Security > IPS in the left navigation pane. The IPS page appears. Click Manage in the IPS Signature Management tile. The Signature Management page appears. Click the IPS Modification Policies  tile. The IPS Modification Policies page appears and displays a list of your configured IPS Modification policies. For each policy, its name, description, and configuration status are displayed. Click the Add  icon. The Add a Policy page appears and displays the Policy Details pane.  Enter a name and, optionally, a description for your new policy. Click the  Feed Provider  drop-down list and select the IPS signature feed provider that you want the policy to apply to. Note: Currently, Proofpoint is the only feed provider available. Click the  Signature Status  drop-down list and select one of the following options: Unmodified—The signature status is unmodified from the signature feed default. Enabled—The verdict selected in the Signature Verdict field is applied to policy matches.  Disabled—Policy matches are ignored by the IPS security engines.  Click the  Signature Verdict  drop-down list and select one of the following verdicts, which has an associated action recommendation for when a policy match occurs: Alert—Permit the traffic and generate an IPS event log. Pass—Permit the traffic.  Drop—Deny the traffic and generate an IPS event log. Reject—Deny the traffic, send a message the sender, and generate an IPS event log. Note: This field is only applied if the Signature Status field is set to Enabled or has not been modified. Click Continue . The Match Criteria pane appears.  Complete the following procedure for each of the criterion you want to include in the policy:  Click the  Add icon. The Add < criterion > dialog appears.  Enter or select one or more entities you want to include as match criteria for the policy. The selected entities are highlighted in green and display a check. Note: If you configure different types of match criteria, they are treated as AND conditionals. If you configure multiple selections for one type of match criteria, they are treated as OR conditionals. Click  Add Selected . The Add a Policy page displays the selected entities for each criterion. Note: The types of match criteria that are displayed are dependent on the provider of the IPS signature feed. Additionally, if the selected feed provider makes internal changes to field names, you will need to update your existing policies to match the updated match criteria options. When Proofpoint is selected as the feed provider, the following match criteria types are displayed: Msg—The name of the signature. Entries for this match criteria must be in the format .*< Msg >.*. For example, if you want to match all signatures that include nmap in their signature name, enter .*.* for this match criteria.  Attack_target—Indicates the intended target of the attack, for example, a client or sever endpoint. Classtype—Indicates the type of activity that a signature is indicative of, for example, an unsuccessful login attempt or a web application attack. Signature_severity—Indicates the severity level of the signature, which corresponds to the potential impact of the detected threat, for example, minor or critical. Category—The type of threat a signature is indicative of, for example, malware or phishing.  SID—The unique identifier of a signature. Deployment—Indicates the context or environment where the signature is meant to be deployed, for example, a perimeter or DMZ. Click  Submit . You are prompted to select one of the following options: Activate Later or Activate Now . See Activate configuration updates for details. When your update is activated, the IPS Modification Policies page displays the policy you added and you can apply the policy to an IPS Signature template. Note: IPS Modification policies are not applied to network traffic until they are included in an IPS Signature template. Complete the Associate an IPS Modification policy with an IPS Signature template procedure to associate this policy with an IPS Signature template. If you need to create an IPS Signature template, see the Configure IPS Signature templates help topic.  To associate an IPS Modification policy with an IPS Signature template Open the IPS Modification Policies page if it is not already open: Log in to MyAryaka. The Home page appears. Click Security > IPS in the left navigation pane. The IPS page appears. Click Manage in the IPS Signature Management tile. The Signature Management page appears. Click the IPS Modification Policies tile. The IPS Modification Policies page appears and displays a list of your configured IPS Modification policies. Click the name of the policy you want to associate with an IPS Signature template. The < policyName > page appears and displays two tiles: Policy Details—Displays the current status of the policy. This tile is selected by default. Template Associations—Displays the number of Signature templates the policy is associated with and their current status. Click the Template Associations tile. The Associated Templates table appears and displays the list of IPS Signature templates that the policy is currently associated with.  Click Edit . The table appears in edit mode. Click Add . The Add Template dialog displays the Signature templates that you can associate with the policy.   Click one or more templates you want to associate with the policy. The selected templates are highlighted in green and display a check. Click  Add Selected . The Associated Templates table displays the selected templates.  (Optional) Repeat steps 5–7 to associate the policy with another Signature template. Click Submit . You are prompted to select one of the following options: Activate Later or Activate Now . See Activate configuration updates for details. When your update is activated, the < policyName > page displays the Signature templates that the Modification policy is associated with.  To edit an IPS Modification policy Log in to MyAryaka. The Home page appears. Click Security > IPS in the left navigation pane. The IPS page appears. Click Manage in the IPS Signature Management tile. The Signature Management page appears. Click the IPS Modification Policies  tile. The IPS Modification Policies page appears and displays a list of your configured IPS Modification policies. For each policy, its name, description, and configuration status are displayed. Click the name of the policy you want to edit. The < policyName > page appears and displays two tiles: Policy Details—Displays the current status of the policy. This tile is selected by default. Template Associations—Displays the number of Signature templates the policy is associated with and their current status. Do one of the following to edit the policy: To render the policy inactive, click Disable . The policy can be enabled again later as needed. To remove the policy, click the Delete  icon. The policy is removed from the list of configured IPS Modification policies.  To edit the details of the policy, click Edit in the Policy Details pane and modify the policy details or match criteria as needed. See steps 6–11 of the Add an IPS Modification policy procedure for details.   To edit the IPS Signature templates that the policy is associated with, click the Template Associations tile. The Associated Templates table appears and displays the list of IPS Signature templates that the policy is currently associated with. Do one of the following and then click Submit : To associate the policy with a Signature template, complete the Associate an IPS Modification policy with an IPS Signature template procedure. To remove an existing association with a Signature template, click Edit and then select the red X in the table row you want to remove.  In this topic Related topics Configure IPS Signature templates View IPS signature feeds Configure global IPS settings Configure site-level security features IPS