Understanding Custom Signatures

There are several reasons where we might need to create custom signatures. If we boil it all down, the main reason for creating custom signatures is to identify traffic that is not addressed, for whatever reason, in the default signature set.

Table 12-2 shows the Cisco IPS signature engines that we can use to create custom signatures. If we don’t know exactly which signature engine to use, there is a wizard that can assist us in determining the correct one.