DefensePro User Guide
Security Configuration
160
Document ID: RDWR-DP-V0602_UG1201
Configuring Signature Protection Attributes
Attributes are components of the protection rules set in the process of rule-based profile
configuration. Attributes are organized according to types based on the various aspects taken into
consideration when defining a new attack, such as environment, applications, threat level, risk levels
and so on.
Each signature is assigned with attributes in different types. The Radware Security Operation Center
(SOC) assigns the attributes when creating the signature creation as a way to describe the signature
in attribute types.
You can use the existing attributes, add new attributes, or remove attributes from the list.
Note:
You can view properties of attribute types, and for the attribute types Complexity,
Confidence, and Risk you can also specify the Match Method (Minimum or Exact). For
more information, see
Viewing and Modifying Attribute Type Properties, page 162
.
HTTP Reply Header
The header of the HTTP reply. This is available only in devices with an
SME.
Mail Domain
In the SMTP header.
Mail From
In the SMTP header.
Mail Subject
In the SMTP header.
Mail To
In the SMTP header.
MM7 File Attachment
The file associated with the MM7 request.
MM7 Request
The request for an MM7 Error message.
Normalized URL
To avoid evasion techniques when classifying HTTP requests, the URL
content is transformed into its canonical representation, interpreting the
URL the same way the server would.
The normalization procedure supports the following:
•
Directory referencing by reducing
/./
into
/
or
A/B/../
to
A/
.
•
Changing backslash (
\
) to slash (
/
).
•
Changing HEX encoding to ASCII characters. For example, the hex
value %20 is changed to a space.
•
Unicode support, UTF-8 and IIS encoding.
POP3 User
User field in the POP3 header.
RPC
Reassembles RPC requests over several packets.
RPC RFC 1831 standard provides a feature called Record Marking
Standard (RM). This feature is used to delimit several RPC requests sent
on top of the transport protocol. For a stream-oriented protocol (like TCP),
RPC uses a kind of fragmentation to delimit between records. In spite of
its original purpose, fragmentation may also divide records in the middle,
not only at their boundaries. This functionality is used to evade IPS
systems.
Text
Anywhere in the packet.
URI Length
Length of the URI packet in bytes.
URL
The HTTP Request URI. No normalization procedures are taken.
Table 81: Content Types
Content Type
Description
Summary of Contents for DefensePro 6.02
Page 1: ...DefensePro User Guide Software Version 6 02 Document ID RDWR DP V0602_UG1201 January 2012 ...
Page 2: ...DefensePro User Guide 2 Document ID RDWR DP V0602_UG1201 ...
Page 20: ...DefensePro User Guide 20 Document ID RDWR DP V0602_UG1201 ...
Page 28: ...DefensePro User Guide Table of Contents 28 Document ID RDWR DP V0602_UG1201 ...
Page 116: ...DefensePro User Guide Device Network Configuration 116 Document ID RDWR DP V0602_UG1201 ...
Page 302: ...DefensePro User Guide Real Time Security Reporting 302 Document ID RDWR DP V0602_UG1201 ...
Page 308: ...DefensePro User Guide Administering DefensePro 308 Document ID RDWR DP V0602_UG1201 ...
Page 324: ...DefensePro User Guide Troubleshooting 324 Document ID RDWR DP V0602_UG1201 ...
