| 12.4 |  | Intrusion Detection |
| 12.4.2 |  | Informational and attack intrusion detection signatures |

| The PIX Security Appliance performs intrusion detection by using intrusion detection signatures. A signature is a set of rules pertaining to typical intrusion activity. Highly skilled network engineers research known attacks and vulnerabilities and can develop signatures to detect these attacks and vulnerabilities. Currently, when intrusion detection is enabled, the PIX Security Appliance is able to monitor over 55 intrusion detection signatures. These signatures can be broken down into two groups, information and attack:

1. Informational Signatures are signatures that are triggered by normal network activity that is not considered to be malicious. The informational signatures can be used to determine the validity of an attack or for forensics purposes.
2. Attack Signatures are signatures that are triggered by an activity known to be malicious, or that could lead to unauthorized data retrieval, system access, or privileged escalation.

Figure lists examples of the IDS signatures supported by the PIX Security Appliance. The signatures supported by the PIX Security Appliance are a subset of the signatures supported by the Cisco IDS product family.

Once a signature has been detected the PIX generates a response that can include sending an alarm to a Syslog server, dropping the packet, or resetting the TCP connection. All IDS Syslog messages start with %PIX-4-4000nn and have the format shown in Figure .