Signature evaluation order

The order that signatures are recognized in SAV is important because a process family or mapping is associated with the first signature that it matches in the Tiers tree. Evaluation order is significant especially when the recognition criteria for a signature matches the same process family or mapping found in multiple signatures.

Signatures are evaluated in a depth-first, top to bottom order: signatures in a tier's sub-tiers are evaluated before the tier's signatures (depth -first), and tiers in the Tiers tree are evaluated from top to bottom. Signatures are applied in the order in which they appear in each tier.

After all user-created tiers and signature hierarchies are evaluated, then all of the default SA signatures are evaluated; for example, NA Management System, NA Syslog Server, and so on. After the SA signatures are evaluated, then all of the default predefined signatures are evaluated; for example, Apache HTTP, Internet Information Server (IIS), and so on.

Consider an application definition that has the structure shown below. In this image, no processes or process families match the signature definitions, and so the signatures are represented with the icon.

Tiers signature evaluation order

In this application definition example, the signatures are evaluated in the following order:

  1. ApplicationSignature7
  2. ApplicationSignature2
  3. ApplicationSignature3
  4. ApplicationSignature4
  5. ApplicationSignature5
  6. ApplicationSignature6
  7. NA Management System
  8. NA Syslog Server
  9. <All remaining SA signatures, top to bottom>
  10. Apache HTTP
  11. Internet Information Services
  12. <All remaining default signatures, top to bottom>