Randy, Anyone with a CCO account can download the signatures. However, as I stated in my earlier e-mail, they're not useful to you unless you have a Cisco IPS sensor, whether a standalone appliance (4200-series), switch module (IDSM-2), firewall module (AIP-10 or 20), router module, or router IOS IPS.
When I say the signatures are open, I mean that there is nothing to prevent you from viewing all settings, modifying them, cloning them, deleting them, or creating your own signatures. The signatures are not "locked" or "hidden", in other words. I would be more than happy to provide you with screenshots showing what the signatures look like, and what options you have for modifying them. Unless the entire list wants to see it, I'll unicast it to you if you want it. I don't want to misuse the list by marketing our products, but if there are things you genuinely want to see, I'll provide it. Gary On 10/12/07 9:00 AM, "[EMAIL PROTECTED]" <[EMAIL PROTECTED]> wrote: > So it is "open" to any paying customer of Cisco? > > What makes Cisco's IDS rules "open" then? I ask because the abuse of the term > is overwhelming. It is my understanding that "open" means the technology plays > well with others, using standardized popular methodology shared amongst the > community. > > Now, I do have a valid CCO account, but we have no IDS devices on the > contracts. Can I still download the rules, despite the warnings given that I > must have a specific contract/license to do so? > > > Thanks, > Randy > > > >> Anyone with a valid license is able to download the signatures to be placed >> on your Cisco sensor. Once you have placed them on your sensor, you are >> free to open/edit/manipulate or add to the signatures at will. >> >> Open signatures does not mean they are "open source" or free. Without a >> Cisco sensor, they won't be much use to you. >> >> If you have a CCO account, you can download the signatures at: >> http://www.cisco.com/cgi-bin/tablebuild.pl/ips6-sigup >> >> Gary >> >> >> >> On 10/12/07 9:59 PM, "Randal T. Rioux" <[EMAIL PROTECTED]> wrote: >> >>> Gary Halleen wrote: >>> <snip> >>>> >>>> Additionally, all Cisco IPS signatures are open. You are able to view all >>>> or most fields of signatures, create your own, and modify existing >>>> signatures. You do not need to wait for Cisco to release new signatures >> if >>>> you have sufficient IDS/IPS skills to write a new signature. If you can >>>> write a snort rule, you can write a Cisco IPS signature. >>> >>> Open? Really? Where can I download them? >>> >>> Thanks, >>> Randy >> >> >> ------------------------------------------------------------------------ >> Test Your IDS >> >> Is your IDS deployed correctly? >> Find out quickly and easily by testing it >> with real-world attacks from CORE IMPACT. >> Go to >> http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=int >> ro >> _sfw >> to learn more. >> ------------------------------------------------------------------------ >> ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more. ------------------------------------------------------------------------
