Replacing a user-defined IDS rule

You can replace a previously imported Snort or Suricata file and use it to scan events and create Intrusion Detection System alerts.

It is highly recommended that you test custom IDS rules in a test environment before you import them. Custom IDS rules may cause performance issues, in which case stable performance of Kaspersky Anti Targeted Attack Platform is not guaranteed

IDs and attributes of custom rules may be modified when they are uploaded. Reject and Drop actions are changed to Alert. Rules with the Pass action are deleted

To replace a custom IDS rule:

In the window of the application web interface, select the Custom rules section, IDS subsection.
This opens the user-defined IDS rule window. Under the rule information, click Replace.
This opens the file selection window on your local computer.
Select the file that you want to upload and click Open.

The user-defined IDS rule is imported into the application, replacing the previously imported rule.

Users with the Security auditor role cannot replace user-defined IDS rules.

Users with the Security officer role cannot gain access to user-defined IDS rules.