Endpoint Protection

Hi guys!

One of my clients is asking if the IPS module of SEP can monitor the JSP files in their servers. They want to know when and who is using those files and the conections to databases that the files make, or see if in a network package for those files there are queries like SELECT, UPDATE and DELETE, also they want to give only some users privileges to use some of the JSP files.

Is this possible with a Custom IPS Signature?

Hope anyone can help me.

Greetings!

I wrote a bunch of sigantures to monitor different files types with custom IPS, you just need to add the JSP extension, follow the same syntax when editing:

https://www-secure.symantec.com/connect/downloads/custom-ips-signatues-detect-various-filetype-downloads

But your policies are for detect downloads, right?

Yea but you can edit the signature to look over different ports/protocols

let us know how it goes, I am curious to know, as this is sometimes a overlooked feature of SEP.

.