Environment
Trellix Intrusion Prevention System (Trellix IPS)
Summary
NOTE: This article is viewable only by registered ServicePortal users.
Push the UDS from the Manager to the Sensors:
The imported UDS isn't pushed to the Sensor until you perform an update. You can roll out the update using either of the following methods:
To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.
User-Defined Signatures (UDSs) are provided as an immediate solution to a security advisory. We write and test these signatures with the objective of a quick turnaround.
A UDS is intended to cover the known aspects of a threat and might not cover all variants. Sometimes, UDS releases might generate incorrect identification.
A UDS is intended to cover the known aspects of a threat and might not cover all variants. Sometimes, UDS releases might generate incorrect identification.
To download a UDS, perform the steps below:
- Click the link to the Knowledge Base article for the UDS that you need to download.
NOTE: UDS articles are registered articles and require you to log on to the ServicePortal.
UDSs Release Date Threat Article Oct 24, 2023 UDS-HTTP: Citrix NetScaler ADC And NetScaler Gateway Information Disclosure Vulnerability KB96844 October 16, 2023 UDS for Cisco IOS XE CVE-2023-20198 & CVE-2021-1435 - UDS-HTTP: Cisco IOS XE Web UI Privilege Escalation Vulnerability (CVE-2023-20198)
- UDS-HTTP: Cisco IOS XE Command Injection Vulnerability (CVE-2021-1435)
KB96834 October 12, 2023 UDS for Multiple Vulnerabilities: - UDS-HTTP: Google Chrome VP8 Libvpx Heap Buffer Overflow Vulnerability (CVE-2023-5217)
- UDS-HTTP: cURL SOCKS5 Proxy Handshake Handling Heap Buffer Overflow Vulnerability
- UDS-HTTP: Atlassian Confluence Broken Access Control Vulnerability (CVE-2023-22515)
KB96822 October 4, 2023 UDS-HTTP: WS_FTP Server Insecure Deserialization Vulnerability (CVE-2023-40044) KB96809 October 3, 2023 UDS-HTTP: Google Chrome WebP BuildHuffmanTable Heap Buffer Overflow Vulnerability (CVE-2023-4863) KB96800 - Download the .zip file attached to the article, which contains the UDS.
NOTE: The .zip file is named using the format .
For example was released on November 4, 2020.
- Extract the downloaded .zip file.
The .zip file extracts into .
- Log on to the Manager.
- Click Policy, Intrusion Prevention, Policy Types.
- For Manager 9.x, click IPS Policies.
- For Manager 10.x and later, including 11.x, click IPS.
- Click the Custom Attacks link at the bottom of the left pane.
- Click Other Actions, and then Import.
- Click Browse and select thefile.
- Deselect the following:
- Import Snort Rules
- Import Snort Macros
- Import Snort Classifications
- Click Import.
- Verify that the number of UDSs that are successfully imported isn't zero (1 or greater).
Push the UDS from the Manager to the Sensors:
The imported UDS isn't pushed to the Sensor until you perform an update. You can roll out the update using either of the following methods:
To apply the UDS to each Sensor one by one:
- Open the Manager.
- Navigate to Devices.
- From the left navigation pane, select the Devices tab.
- From the drop-down list, select the Sensor that you want to push the update to.
- Click Deploy Pending Changes. The option must already be selected.
- To start updating the Sensor, click Update/Deploy.
To apply the UDS to all Sensors:
- Open the Manager.
- Navigate to Devices.
- From the left navigation pane, select the Global tab.
- Click Deploy Pending Changes. Each Sensor requiring an update must be selected.
- To start updating the Sensors, click Update/Deploy.
Related Information
References to product versions that have reached End of Life have been removed from this article. We strongly recommend that you upgrade to a supported version.
For End of Life (EOL) information, see Product End of Life Information.
For EOL policy details, see the Corporate Products EOL policy.
Definitions:
For EOL policy details, see the Corporate Products EOL policy.
Definitions:
- EOL period—The time frame that runs from the day we announce product discontinuation, until the last date that we formally support the product. In general, after the EOL period is announced, no enhancements are made.
- EOL date—The last day that the product is supported, according to the terms of our standard support offering.