Fortinet black logo

Custom IPS and Application Control Signature Syntax Guide

Home IPS Engine 7.2.0 Custom IPS and Application Control Signature Syntax Guide
7.2.0
7.4.0
7.2.0
7.1.0
7.0.0
6.4.0
6.2.0
5.2.0
3.6.0

weight

weight

Use this keyword to specify the weight to be assigned to the signature. While optional, this keyword is useful because it allows a signature with the higher weight to have priority over a signature with a lower weight.

The weight must be between 0 and 255. Most of the signatures in the Application Control signature database have weights of 10; botnet signatures are set to 250. A range of 20 to 50 is recommended for custom signatures.

Syntax:
--weight <weight_int>;
Example: 
F-SBID(--attack_id 8151; --vuln_id 8151; --name "Windows.NT.5.Web.Surfing"; --default_ action drop_session; --service HTTP; --protocol tcp; --app_cat 25; --flow from_client; -- pattern !"FCT"; --pattern "Windows NT 5.1"; --no_case; --context header; --weight 40; )
Previous
Next

weight

Use this keyword to specify the weight to be assigned to the signature. While optional, this keyword is useful because it allows a signature with the higher weight to have priority over a signature with a lower weight.

The weight must be between 0 and 255. Most of the signatures in the Application Control signature database have weights of 10; botnet signatures are set to 250. A range of 20 to 50 is recommended for custom signatures.

Syntax:
--weight <weight_int>;
Example: 
F-SBID(--attack_id 8151; --vuln_id 8151; --name "Windows.NT.5.Web.Surfing"; --default_ action drop_session; --service HTTP; --protocol tcp; --app_cat 25; --flow from_client; -- pattern !"FCT"; --pattern "Windows NT 5.1"; --no_case; --context header; --weight 40; )
Previous
Next