Are you being asked to tune an existing signature or to create a custom signature ?
If just tuning an existing signature - say for instance to change the severity level of ICMP Echo, then look for the signature and make the changes are required. For creating a custom signature, I havent cloned any other signatures and tuned them to the requirements. I use the wizard and select the options I need. The trickier part for me is knowing which engine to select and possibly also the summarization. If I think the signature might be similar to another, then I'll look up the other signature to find out what engine it falls under, then create the custom one using the same engine. Mark On Thu, Jun 2, 2011 at 4:20 AM, Bruno <[email protected]> wrote: > If we are asked to do any tune, would clone a existing signature and tune > the new 60000 signature be wrong? > Like, clone 2004 and tune the former one instead > > Give me your opinions > > -- > Bruno Fagioli (by Jaunty Jackalope) > Cisco Security Professional > > _______________________________________________ > For more information regarding industry leading CCIE Lab training, please > visit www.ipexpert.com > > Are you a CCNP or CCIE and looking for a job? Check out > www.PlatinumPlacement.com >
_______________________________________________ For more information regarding industry leading CCIE Lab training, please visit www.ipexpert.com Are you a CCNP or CCIE and looking for a job? Check out www.PlatinumPlacement.com
