Attack Signatures are still the same after importing UCS (v10.2.4)

After upgrading our box to the 11.3.0 version (coming from 10.2.4) we wanted to upload the ucs file onto the box. According to sol8217 we should have the attack signatures of the old 10.2.4 version but this is not the case. All new attack signatures have been added and immediately placed in blocking mode.

 

fragment from sol8217 Attack signatures are also saved in user configuration set (UCS) archives. When a UCS archive is created, the current cumulative signature set is saved in the archive. When a UCS archive is restored, the attack signatures in the archive fully replace existing signatures. If the UCS archive is old, the attack signatures may be out-of-date and need to be updated separately.

 

We would like to perform the upgrade so that the attack signatures are still the same as on our old version. When the upgrade is complete we will manually upgrade our attack signatures which will be placed in learning/staging for the first few weeks. This is crucial for our own inhouse applications that are available through the ASM.

 

Has anybody else had this 'issue' before?