Skip to main content

Trellix: IPS Emergency UDS Release Bulletin - UDS for Multiple Vulnerabilities

Updated

Environment

Trellix Intrusion Prevention System (Trellix IPS)

Summary

User-Defined Signatures (UDSs) are provided as an immediate solution to a security advisory. We write and test these signatures with the objective of a quick turnaround.
A UDS is intended to cover the known aspects of a threat and might not cover all variants. Sometimes, UDS releases might generate incorrect identification.

To download a UDS, perform the steps below:

  1. Click the link to the Knowledge Base article for the UDS that you need to download.
     
    UDSs
    Release Date Threat Article
    Dec 02 2024 UDS-HTTP: WordPress Plugin PegaPoll Privilege Escalation Vulnerability (CVE-2024-50490) Release Notes
    November 22, 2024 UDS for Multiple Vulnerabilities Release Notes
    November 5, 2024 UDS for Multiple Vulnerabilities Release Notes
     
  2. Download the .zip file attached to the article, which contains the UDS.

    Note: The .zip file is named using the format UDS <date of release>.zip.
    For example, UDS-11042020.zip was released on November 4, 2020.
     
  3. Extract the downloaded .zip file.
    The .zip file extracts into Emergency_UDS_xxx.zip.

To import the UDS to the Manager, perform the steps below:

  1. Log on to the Manager.
  2. Click Policy, Intrusion Prevention, Policy Types.
    • For Manager 9.x, click IPS Policies.
    • For Manager 10.x and later, including 11.x, click IPS.
       
  3. Click the Custom Attacks link at the bottom of the left pane.
  4. Click Other Actions, and then Import.
  5. Click Browse and select the Emergency_UDS_xxx.zip file.
     
  6. Deselect the following:
    • Import Snort Rules
    • Import Snort Macros
    • Import Snort Classifications
       
  7. Click Import.
  8. Verify that the number of UDSs that are successfully imported is not zero (1 or greater).

Push the UDS from the Manager to the Sensors:

The imported UDS is not pushed to the Sensor until you perform an update. You can roll out the update using either of the following methods: 

To apply the UDS to each Sensor one by one:
  1. Open the Manager.
  2. Navigate to Devices.
  3. From the left navigation pane, select the Devices tab.
  4. From the drop-down list, select the Sensor that you want to push the update to.
  5. Click Deploy Pending Changes. The option must already be selected.
  6. To start updating the Sensor, click Update/Deploy.
To apply the UDS to all Sensors:
  1. Open the Manager.
  2. Navigate to Devices.
  3. From the left navigation pane, select the Global tab.
  4. Click Deploy Pending Changes. Each Sensor requiring an update must be selected.
  5. To start updating the Sensors, click Update/Deploy.

Related information

References to product versions that have reached End of Life have been removed from this article. We strongly recommend that you upgrade to a supported version.
 
For details on supported and End-of-Life (EOL) products, see Trellix Product End-of-Life Information.
Powered by Zendesk