Editing custom patterns

The following steps are required in order to edit custom patterns:

On the development workstation:

  1. In the CustomPatterns.in file:
  • Edit the section that defines the pattern,
  • Increment the Revision field of the corresponding context.
  1. Transfer this file to the acceptance testing firewall to replace the existing CustomPatterns.in file.

- or -

On the acceptance testing firewall, run the CustomPatterns.in file:

  • Edit the section that defines the pattern,
  • Increment the Revision field of the corresponding context.

On the acceptance testing firewall:

  1. Validate the custom pattern file:

enpattern -t /usr/Firewall/ConfigFiles/CustomPatterns.in.

  1. Compile the signatures:

enpattern -fav

  1. Enable the patterns in the intrusion prevention engine:

enasq

  1. In Application protection > Applications and protections, ensure that this pattern is present.
  2. Test the changes made to your custom pattern by using appropriate network traffic. Ensure that the alarm is raised as expected (Dashboard > Alarms widget).

Deploy the new custom pattern archive on your Active Update server.