Rules Life Cycle

Each IDS Rule has a life cycle, this cycle starts by the creation of the rule and assignment of a unique SID (signature ID) to it, and a revision number.

Each time a Cyber Security Analyst or a Security Engineer update this rule to improve its detection logic, it will be assigned a new revision number.

Publicly available IDS Ruleset like Emerging Threats follow this methodology, each time a rule gets improved, it will be published with the same SID but with a new revision number.

All of those rules are published in text files, this makes tracking those changes time consuming, moreover some of the Security Teams follow QA procedures that require the inspection of these new IDS Rules before deploying this to production, which again is very hard when dealing with text files.

To solve those issues, IDSTower tracks rules SID and revisions and assign each IDS Rule one of four statuses:

  • Enabled: Means the rule is enabled and will be deployed to the IDS Hosts.

  • Disabled: Means the rule is disabled and it will not be deployed to the IDS Hosts, moreover if you import a new revision of this rule (via Feeds or files) it will be assigned Disabled status as well, this is to make sure that when you disable a rule, it won’t be re-enabled in future rules updates.

  • Expired: This status is assigned to old revision of a rule, when IDSTower updates the rules (via feeds or files) and encounter a new revision, it will assign the old revision an expired status, a rule with expired status won’t be deployed to IDS Hosts, please note that this behavior is configurable.

  • Review: Means the IDS Rule is waiting to be manually reviewed by Analyst/Engineer, you can configure IDSTower to assign “Review” status to new rules (identified by new SID) or new revisions.

Automatic Cleanup of Expired Rules

Since every rule update creates a new revision and marks the previous one as Expired, expired rule revisions can grow into hundreds of thousands of records over time, especially when multiple rules feeds are enabled.

To keep the database lean, IDSTower automatically deletes expired rule revisions that have been expired for a configurable period of time (6 months by default), this cleanup runs once a day and can be configured (or disabled) from the settings -> Rules tab, under the “Rules Cleanup” section.

Deleting expired rule revisions does not affect your deployed rulesets, since only rules with the Enabled status are deployed to the IDS Hosts, deleted revisions are recorded in the rule’s change history.

Next, we will see features offered by the IDS Rules Management interface