Description

This article provides information on how to view the individual IDP attacks that are listed under a pre-defined attack group.

Symptoms

How to view the individual IDP attacks that are listed under a pre-defined attack group.

Solution


  1. Configure a test policy with the required attack group: 
    root@3400-3# show security idp
idp-policy test {
  rulebase-ips {
    rule 1 {
      match {
        from-zone trust;
        source-address any;
        to-zone trust;
        destination-address any;
        attacks {
          predefined-attack-groups "[Recommended]SMTP - Major";
        }
      }
      then {
        action {
          drop-packet;
        }
      }
   }
}
  2. After the commit, check /var/db/idpd/sets/ <policy-name> .set : 
    root@3400-3# run file show /var/db/idpd/sets/test.set | find "SMTP - Major" 

:"[Recommended]SMTP - Major" ("[Recommended]SMTP - Major"
:type (group)
:group (
:members (
: ("SMTP:COMMAND:STARTTLS-CMD")
: ("SMTP:DOS:CLAM-TNEF-DOS")
: ("SMTP:DOS:MS-MALWARE-ENGINE")
: ("SMTP:EMAIL:RELAY-ADDR-OF")
: ("SMTP:EXCHANGE:IMAP-DOS")
: ("SMTP:EXPLOIT:BITDEF-LOG")
: ("SMTP:EXPLOIT:KERIO-MS-FS")
: ("SMTP:EXT:DOUBLE-EXTENSION-MIME")
: ("SMTP:FROM-FIELD-FS")
: ("SMTP:MAL:EXIM4-HEADER")
: ("SMTP:MAL:LOTUS-VIEWER")
: ("SMTP:MERCMAIL-AUTH-OF")
: ("SMTP:OVERFLOW:EMAIL-DOMAIN")
: ("SMTP:OVERFLOW:EMAIL-USERNAME")
: ("SMTP:OVERFLOW:NTLM-AUTH-OF")
: ("SMTP:RCPT-CMD-INJ")
: ("SMTP:SPAM-ASSN-INJ")
: ("SMTP:VULN:GROUPWISE-IMG-OF")
)
............
For certain pre-defined attack groups, you will not find any constituent attacks. This is due to the pre-defined attack group actually not containing any attacks and it will be used in the future, if the attacks qualify, as per the criteria for that particular attack group.

Note : You can easily view the Individual attacks that are listed under a pre-defined attack group via NSM.