Forum Discussion
NimbostratusUpdating attack signatures (best practice)
AltostratusI doubt that there won't be any impact by updating the Signature Database if you put newly added signatures into Staging.
We have seen a case where all the Manual Traffic Learning violations been taken care. We upgraded the signature database and it was found that a couple of rivisioned signatures started triggering the false positives.
Since customer is having 2 different F5 setup, one for DC and one for DR, we have upgraded the Signature set only for DR and during the testing, traffic started hitting an enhanced signature and the old Signature was also there.
Production traffic was passing through the DC Site and there were no violations. There I learned that updating the Signature Database can have minor or major impact on traffic processing, irrespective of the fact that newly added signatures are in Staging.
I hope this would help.
Cheers! Darshan
NimbostratusIn case of recent BigIP releases (I think it's 11.4 and later), all new signatures, and optionally existing (but modified) signatures will be put to Staging when installing updates. In case of older BigIP versions, this might not have been the case. Do you remember what was the version of BigIP when that incident occurred?
