Signature set is a comprehensive set of attack definitions developed and provided by Trellix Labs. An attack definition contains one or more signatures, which indicate suspicious or malicious activity. These signatures are then matched against traffic passing through the Sensor monitoring ports.
Each attack definition can be configured to perform response actions like sending an alert to the Manager, dropping traffic, capturing packets, or generating an email. It is used to detect threats and anomalies in the network traffic.
Signature sets are available in Trellix IPS Update Server (Update Server). Trellix regularly updates the signature set with latest attack definitions which you can download from the Update Server.
The threat landscape is constantly evolving, and new attacks are regularly added to the signature set to keep the network protection up-to-date. The attack definitions in the signature set are categorized as high, medium, and low priority attacks. This helps optimize Sensor resources on older Sensor models and Sensors running older software versions, thereby protecting against the most critical and relevant attacks.
Based on the priority attribute configured for the Sensor models, the Manager dynamically compiles the signature set using the current signature set version available in the Manager. The corresponding set of attack definitions are then pushed to the Sensors.
The NS-series and Virtual IPS Sensor models support high, medium, and low priority attack definitions, thereby providing complete attack coverage. The M-series Sensor models support high and medium priority attack definitions which optimizes Sensor resources.
The availability of attack definitions in the signature set is based on Sensor models:
| Sensor Models | Signature Set Attack Priorities | ||
|---|---|---|---|
| High Only | High and Medium Only | All | |
NS-series:
|
Yes | Yes | Yes |
Virtual IPS:
|
Yes | Yes | Yes |
M-series:
|
Yes | Yes | No |
Note
Sensor software versions 9.2 and 10.1 are not supported on the M-series Sensor model. However, you can manage the M-series Sensors running older software version using the Manager version 9.2 and 10.1. To secure your network with the complete signature set, Trellix recommends you to migrate your M-series Sensors to the latest NS-series or Virtual IPS Sensors.