Signature sets

The Signature Sets option enables you to download available attack signature updates on demand from the Update Server to the Manager server. You can then push the signature download onto your Sensors. You can also download the latest signature sets from an offline utility OfflineSigsetDownloader. For more information, see Offline Signature Set Downloader.

Tip

Because incremental emergency signature sets can be downloaded with regular signature sets, you do not need to use the custom attack definitions feature to import late-breaking attacks.

The Signature Sets option not only allows you to import regular signature sets, but also incremental emergency signature sets that include attack signatures not yet available in regular signature sets.

Incremental emergency signature sets are meant to address late-breaking attacks that might need to be addressed immediately.

Emergency signature sets are non-cumulative and can only add new signatures, so they do not contain a full set of signatures.

To make sure that you have a complete set of signatures, Trellix IPS verifies to see if a required regular signature set is missing and downloads it before downloading the related emergency signature set.

Note

You must use the Automatic Download option of Signature Sets tab from Manager → <Admin Domain Name> → Trellix IPS Protection Status for Trellix IPS to download a required regular signature set automatically, before downloading an emergency signature set. You receive an error if you try to import an emergency signature set through the Manual Import tab. For more information about Automatic Download, refer to Automatic download of Signature sets.

When a signature file or version is downloaded, the version is displayed in the Active Manager Version. Setting a schedule enables the Manager to verify the Update Server for signature updates on a periodic basis, download the available updates, and push these updates to your Sensors without your intervention.

Note

The signature set's major version (i.e, its first two digits) should be equal to or higher than the IPS Manager's major version (i.e, its first two digits) for it to be compatible with the Manager. Starting from 11.1 Update 2 or later, the Manager performs validation based on the signature set file's major version being equal to or higher than its major version and thus prevents the download or manual import of any incompatible signature set version that does not match the validation criteria.

For example, any Manager running on version 11.1 Update 2 supports the download and deployment of signature set version 11.9.x.x, but not signature set version 10.8.x.x or 9.8.x.x. In case of an incompatible signature set file download or its manual import, an error message is displayed on the Manager UI. You can find more details about the error from the ems.log file, or check for the same log entries on the Manager → <Admin Domain Name> → Troubleshooting → Logs → System Files tab.