<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<configuration xmlns="http://www.cisco.com/cids/idiom" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.cisco.com/cids/idiom http://www.cisco.com/cids/idiom/1.00/idiom.xsd" schemaVersion="1.00">
<!-- ======================================================================== *
 * Copyright (c) 2003-2005 by cisco Systems, Inc.                            *
 * All rights reserved.                                                       *
 * ======================================================================== -->
  <typedefs typedefsVersion="1.00">
    <tString typeName="Version" />
    <tEnum typeName="BOOL" min="1" max="1">
      <value name="False" descr="Set value to false" />
      <value name="True" descr="Set value to true" />
    </tEnum>
    <tInteger typeName="NUMBER" type="unsigned" />
    <tString typeName="STRING" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tIntegerRange typeName="SET(RANGE(1-65535))" allowMultiple="true" type="unsigned" min="0" max="65535" />
    <tInteger typeName="AlarmDelayTimer" min="1" max="3600" type="unsigned" />
    <tInteger typeName="NUMBER(2-1000)-AlarmInterval" min="2" max="1000" type="unsigned" />
    <tEnum typeName="ENUM(high,informational,low,medium)-AlarmSeverity" min="1" max="1">
      <value name="high" descr="Most serious security alert" />
      <value name="informational" descr="Network activity, not security alert" />
      <value name="low" descr="Least serious security alert" />
      <value name="medium" descr="Moderate security alert" />
    </tEnum>
    <tEnum typeName="ENUM(FireAll,GlobalSummarize)-AlarmThrottle" min="1" max="1">
      <value name="FireAll" descr="All alerts in an interval are sent, possibly limited by ChokeThreshold" />
      <value name="GlobalSummarize" descr="Send summary alert per-interval, per-signature" />
    </tEnum>
    <tInteger typeName="NUMBER(0-65535)-AlarmTraits" min="0" max="65535" type="unsigned" />
    <tEnum typeName="ENUM(True,False)-CapturePacket" min="1" max="1">
      <value name="True" descr="Set value to true." />
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tInteger typeName="NUMBER(0-65535)-ChokeThreshold" min="0" max="65535" type="unsigned" />
    <tEnum typeName="ENUM(True,False)-Enabled" min="1" max="1">
      <value name="True" descr="Set value to true." />
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tEnum typeName="ENUM(alarm,drop,reset,denyAttackerInline,denyFlowInline)-EventAction" min="1" max="5">
      <value name="alarm" descr="Send a signature alarm message" />
      <value name="drop" descr="Drop the offending packet" />
      <value name="reset" descr="Perform TCP RESET on connection and drop the offending packet" />
      <value name="denyAttackerInline" descr="Do not transmit future packets originating from the attacker address for a specified period of time" />
      <value name="denyFlowInline" descr="Do not transmit future packets on the Flow for specified period of time" />
    </tEnum>
    <tEnum typeName="ENUM(True,False)-FlipAddr" min="1" max="1">
      <value name="True" descr="Set value to true." />
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tInteger typeName="NUMBER(0-65535)-MaxInspectLength" min="0" max="65535" type="unsigned" />
    <tInteger typeName="NUMBER(0-1000)-MaxTTL" min="0" max="1000" type="unsigned" />
    <tInteger typeName="NUMBER(0-65535)-MinHits" min="0" max="65535" type="unsigned" />
    <tInteger typeName="NUMBER(2-1000)-ResetAfterIdle" min="2" max="1000" type="unsigned" />
    <tIntegerRange typeName="SET(RANGE(1-65535))-ServicePorts" allowMultiple="true" type="unsigned" min="1" max="65535" />
    <tString typeName="STRING-SigComment" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tInteger typeName="NUMBER(993-50000)-SIGID" min="993" max="50000" type="unsigned" />
    <tString typeName="STRING-SigName" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tString typeName="STRING-SigStringInfo" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tString typeName="STRING-SigVersion" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tInteger typeName="NUMBER(0-255)-SubSig" min="0" max="255" type="unsigned" />
    <tInteger typeName="NUMBER(0-1000)-ThrottleInterval" min="0" max="1000" type="unsigned" />
    <tEnum typeName="ENUM(True,False)-WantFrag" min="1" max="1">
      <value name="True" descr="Interested only in frags" />
      <value name="False" descr="Interested only in non-frags" />
    </tEnum>
    <tString typeName="STRING-DstIpAddr-ATOMIC.ICMP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tString typeName="STRING-DstIpMask-ATOMIC.ICMP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tInteger typeName="NUMBER(0-255)-IcmpCode-ATOMIC.ICMP" min="0" max="255" type="unsigned" />
    <tInteger typeName="NUMBER(0-65535)-IcmpId-ATOMIC.ICMP" min="0" max="65535" type="unsigned" />
    <tInteger typeName="NUMBER(0-255)-IcmpMaxCode-ATOMIC.ICMP" min="0" max="255" type="unsigned" />
    <tInteger typeName="NUMBER(0-65535)-IcmpMaxSeq-ATOMIC.ICMP" min="0" max="65535" type="unsigned" />
    <tInteger typeName="NUMBER(0-255)-IcmpMinCode-ATOMIC.ICMP" min="0" max="255" type="unsigned" />
    <tInteger typeName="NUMBER(0-65535)-IcmpMinSeq-ATOMIC.ICMP" min="0" max="65535" type="unsigned" />
    <tInteger typeName="NUMBER(0-65535)-IcmpSeq-ATOMIC.ICMP" min="0" max="65535" type="unsigned" />
    <tInteger typeName="NUMBER(0-255)-IcmpType-ATOMIC.ICMP" min="0" max="255" type="unsigned" />
    <tInteger typeName="NUMBER(0-255)-IpTOS-ATOMIC.ICMP" min="0" max="255" type="unsigned" />
    <tEnum typeName="ENUM(ICMP)-Protocol-ATOMIC.ICMP" min="1" max="1">
      <value name="ICMP" descr="Interested in L4 ICMP protocol" />
    </tEnum>
    <tString typeName="STRING-SrcIpAddr-ATOMIC.ICMP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tString typeName="STRING-SrcIpMask-ATOMIC.ICMP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tEnum typeName="ENUM(xxxx)-StorageKey-ATOMIC.ICMP" min="1" max="1">
      <value name="xxxx" descr="Interested in GLOBAL (all addresses wildcarded) storage" />
    </tEnum>
    <tEnum typeName="ENUM(xxxx)-SummaryKey-ATOMIC.ICMP" min="1" max="1">
      <value name="xxxx" descr="Summarization groupings on all addresses" />
    </tEnum>
    <tArray typeName="ATOMIC.ICMP-Signatures" max="1000">
      <member type="AlarmDelayTimer" name="AlarmDelayTimer" important="False" supported="False" descr="Number of seconds to delay further signature inspection after an alarm." />
      <member type="NUMBER(2-1000)-AlarmInterval" name="AlarmInterval" important="False" supported="True" descr="Special Handling for timed events.  Use AlarmInterval Y with MinHits X for X alarms in Y second interval." />
      <member type="ENUM(high,informational,low,medium)-AlarmSeverity" name="AlarmSeverity" important="True" supported="True" descr="The severity of this alert reported in the alarm." default="medium" />
      <member type="ENUM(FireAll,GlobalSummarize)-AlarmThrottle" name="AlarmThrottle" important="False" supported="True" descr="Technique used to limit alarm firings." default="FireAll" />
      <member type="NUMBER(0-65535)-AlarmTraits" name="AlarmTraits" important="False" supported="True" descr="User-defined traits further describing this signature." />
      <member type="ENUM(True,False)-CapturePacket" name="CapturePacket" important="False" supported="False" descr="Set to True to include the offending packet in the alarm." default="False" />
      <member type="NUMBER(0-65535)-ChokeThreshold" name="ChokeThreshold" important="False" supported="True" descr="Threshold value of alarms-per-interval to auto-switch AlarmThrottle modes. If ChokeThreshold is defined the sensor will automatically switch AlarmThrottle modes when a large volume of alarms is seen in the ThrottleInterval." default="100" />
      <member type="STRING-DstIpAddr-ATOMIC.ICMP" name="DstIpAddr" important="False" supported="False" descr="IP address (or network) to match on the IP packet's destination address. Must be used with DstIpMask." />
      <member type="STRING-DstIpMask-ATOMIC.ICMP" name="DstIpMask" important="False" supported="False" descr="IP netmask used with DstIpAddr to match on the IP packet's destination address. Must be used with DstIpAddr." />
      <member type="ENUM(True,False)-Enabled" name="Enabled" important="True" supported="True" descr="True to Enable the Sig. False to Disable the Sig." required="yes" default="True" />
      <member type="ENUM(alarm,drop,reset,denyAttackerInline,denyFlowInline)-EventAction" name="EventAction" important="True" supported="True" descr="What action(s) to perform when the alarm is fired." default="alarm" />
      <member type="ENUM(True,False)-FlipAddr" name="FlipAddr" important="True" supported="True" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)." />
      <member type="NUMBER(0-255)-IcmpCode-ATOMIC.ICMP" name="IcmpCode" important="True" supported="True" descr="ICMP header CODE value" />
      <member type="NUMBER(0-65535)-IcmpId-ATOMIC.ICMP" name="IcmpId" important="True" supported="True" descr="ICMP header IDENTIFIER value" />
      <member type="NUMBER(0-255)-IcmpMaxCode-ATOMIC.ICMP" name="IcmpMaxCode" important="True" supported="True" descr="ICMP CODE values above this will cause alarm." />
      <member type="NUMBER(0-65535)-IcmpMaxSeq-ATOMIC.ICMP" name="IcmpMaxSeq" important="True" supported="True" descr="ICMP SEQ values above this will cause alarm." />
      <member type="NUMBER(0-255)-IcmpMinCode-ATOMIC.ICMP" name="IcmpMinCode" important="True" supported="True" descr="ICMP CODE values below this will cause alarm." />
      <member type="NUMBER(0-65535)-IcmpMinSeq-ATOMIC.ICMP" name="IcmpMinSeq" important="True" supported="True" descr="ICMP SEQ values below this will cause alarm." />
      <member type="NUMBER(0-65535)-IcmpSeq-ATOMIC.ICMP" name="IcmpSeq" important="True" supported="True" descr="ICMP header SEQUENCE value" />
      <member type="NUMBER(0-255)-IcmpType-ATOMIC.ICMP" name="IcmpType" important="True" supported="True" descr="ICMP header TYPE value" />
      <member type="NUMBER(0-255)-IpTOS-ATOMIC.ICMP" name="IpTOS" important="True" supported="True" descr="IP header TYPE OF SERVICE value" />
      <member type="NUMBER(0-65535)-MaxInspectLength" name="MaxInspectLength" important="False" supported="False" descr="Maximum number of bytes to inspect." />
      <member type="NUMBER(0-1000)-MaxTTL" name="MaxTTL" important="False" supported="False" descr="Maximum number of seconds to inspect a logical stream. The inspector is deleted after X seconds of being active." />
      <member type="NUMBER(0-65535)-MinHits" name="MinHits" important="False" supported="True" descr="Minimum number of signature hits before the alarm message is sent.  This a limitter for firing the alarm only after X times of seeing the signature on the address key." />
      <member type="ENUM(ICMP)-Protocol-ATOMIC.ICMP" name="Protocol" important="True" supported="True" descr="Protocol of interest for this inspector." required="yes" default="ICMP" />
      <member type="NUMBER(2-1000)-ResetAfterIdle" name="ResetAfterIdle" important="False" supported="False" descr="Number of seconds to wait to reset signature counters after the host(s) were idle." default="15" />
      <member type="STRING-SigComment" name="SigComment" important="False" supported="True" descr="USER NOTES - miscellaneous information about this signature." />
      <member type="NUMBER(993-50000)-SIGID" name="SIGID" important="True" supported="True" descr="Signature Identifier. 993-19999 valid for default signatures. 20000-50000 valid for user signatures.where parameter" required="yes" key="true" />
      <member type="STRING-SigName" name="SigName" important="True" supported="True" descr="Official name of the signature." />
      <member type="STRING-SigStringInfo" name="SigStringInfo" important="False" supported="True" descr="Extra information included in the alarm message." />
      <member type="STRING-SigVersion" name="SigVersion" important="True" supported="True" descr="Signature update version of signature" />
      <member type="STRING-SrcIpAddr-ATOMIC.ICMP" name="SrcIpAddr" important="False" supported="False" descr="IP address (or network) to match on the IP packet's source address. Must be used with SrcIpMask." />
      <member type="STRING-SrcIpMask-ATOMIC.ICMP" name="SrcIpMask" important="False" supported="False" descr="IP netmask used with SrcIpAddr to match on the IP packet's destination address. Must be used with SrcIpAddr." />
      <member type="ENUM(xxxx)-StorageKey-ATOMIC.ICMP" name="StorageKey" important="True" supported="True" descr="Type of Address Key used to store persistent data." required="yes" default="AaBb" />
      <member type="NUMBER(0-255)-SubSig" name="SubSig" important="True" supported="True" descr="Sub-Signature ID.  Denotes a specific variant of a signature." default="0" key="true" />
      <member type="ENUM(xxxx)-SummaryKey-ATOMIC.ICMP" name="SummaryKey" important="False" supported="True" descr="The Storage Type on which to summarize this signature." required="yes" default="xxxx" />
      <member type="NUMBER(0-1000)-ThrottleInterval" name="ThrottleInterval" important="False" supported="True" descr="Number of seconds defining an Alarm Throttle interval.  This is used with the AlarmThrottle parameter to tune special alarm limiters." default="30" />
      <member type="ENUM(True,False)-WantFrag" name="WantFrag" important="True" supported="True" descr="True if a fragment is desired.  False if a fragment is not desired.  Any for either." />
    </tArray>
    <tStruct typeName="ATOMIC.ICMP" SigMemory="5825">
      <member type="Version" name="version" descr="Engine Version" />
      <member type="ATOMIC.ICMP-Signatures" name="signatures" descr="Simple ICMP alarms based on Type, Code, Seq, Id, etc." />
    </tStruct>
    <tEnum typeName="ENUM(True,False)-HasBadOption-ATOMIC.IPOPTIONS" min="1" max="1">
      <value name="True" descr="Set value to true." />
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tInteger typeName="NUMBER(0-255)-IpOption-ATOMIC.IPOPTIONS" min="0" max="255" type="unsigned" />
    <tEnum typeName="ENUM(IP)-Protocol-ATOMIC.IPOPTIONS" min="1" max="1">
      <value name="IP" descr="Interested in L3 IP protocol" />
    </tEnum>
    <tEnum typeName="ENUM(xxxx)-StorageKey-ATOMIC.IPOPTIONS" min="1" max="1">
      <value name="xxxx" descr="Interested in GLOBAL (all addresses wildcarded) storage" />
    </tEnum>
    <tEnum typeName="ENUM(xxxx)-SummaryKey-ATOMIC.IPOPTIONS" min="1" max="1">
      <value name="xxxx" descr="Summarization groupings on all addresses" />
    </tEnum>
    <tArray typeName="ATOMIC.IPOPTIONS-Signatures" max="1000">
      <member type="AlarmDelayTimer" name="AlarmDelayTimer" important="False" supported="False" descr="Number of seconds to delay further signature inspection after an alarm." />
      <member type="NUMBER(2-1000)-AlarmInterval" name="AlarmInterval" important="False" supported="True" descr="Special Handling for timed events.  Use AlarmInterval Y with MinHits X for X alarms in Y second interval." />
      <member type="ENUM(high,informational,low,medium)-AlarmSeverity" name="AlarmSeverity" important="True" supported="True" descr="The severity of this alert reported in the alarm." default="medium" />
      <member type="ENUM(FireAll,GlobalSummarize)-AlarmThrottle" name="AlarmThrottle" important="False" supported="True" descr="Technique used to limit alarm firings." default="FireAll" />
      <member type="NUMBER(0-65535)-AlarmTraits" name="AlarmTraits" important="False" supported="True" descr="User-defined traits further describing this signature." />
      <member type="ENUM(True,False)-CapturePacket" name="CapturePacket" important="False" supported="False" descr="Set to True to include the offending packet in the alarm." default="False" />
      <member type="NUMBER(0-65535)-ChokeThreshold" name="ChokeThreshold" important="False" supported="True" descr="Threshold value of alarms-per-interval to auto-switch AlarmThrottle modes. If ChokeThreshold is defined the sensor will automatically switch AlarmThrottle modes when a large volume of alarms is seen in the ThrottleInterval." default="100" />
      <member type="ENUM(True,False)-Enabled" name="Enabled" important="True" supported="True" descr="True to Enable the Sig. False to Disable the Sig." required="yes" default="True" />
      <member type="ENUM(alarm,drop,reset,denyAttackerInline,denyFlowInline)-EventAction" name="EventAction" important="True" supported="True" descr="What action(s) to perform when the alarm is fired." default="alarm" />
      <member type="ENUM(True,False)-FlipAddr" name="FlipAddr" important="True" supported="True" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)." />
      <member type="ENUM(True,False)-HasBadOption-ATOMIC.IPOPTIONS" name="HasBadOption" important="True" supported="True" descr="The list of options is malformed." />
      <member type="NUMBER(0-255)-IpOption-ATOMIC.IPOPTIONS" name="IpOption" important="True" supported="True" descr="IP OPTION Code to match." />
      <member type="NUMBER(0-65535)-MaxInspectLength" name="MaxInspectLength" important="False" supported="False" descr="Maximum number of bytes to inspect." />
      <member type="NUMBER(0-1000)-MaxTTL" name="MaxTTL" important="False" supported="False" descr="Maximum number of seconds to inspect a logical stream. The inspector is deleted after X seconds of being active." />
      <member type="NUMBER(0-65535)-MinHits" name="MinHits" important="False" supported="True" descr="Minimum number of signature hits before the alarm message is sent.  This a limitter for firing the alarm only after X times of seeing the signature on the address key." />
      <member type="ENUM(IP)-Protocol-ATOMIC.IPOPTIONS" name="Protocol" important="True" supported="True" descr="Protocol of interest for this inspector." required="yes" default="IP" />
      <member type="NUMBER(2-1000)-ResetAfterIdle" name="ResetAfterIdle" important="False" supported="False" descr="Number of seconds to wait to reset signature counters after the host(s) were idle." default="15" />
      <member type="STRING-SigComment" name="SigComment" important="False" supported="True" descr="USER NOTES - miscellaneous information about this signature." />
      <member type="NUMBER(993-50000)-SIGID" name="SIGID" important="True" supported="True" descr="Signature Identifier. 993-19999 valid for default signatures. 20000-50000 valid for user signatures.where parameter" required="yes" key="true" />
      <member type="STRING-SigName" name="SigName" important="True" supported="True" descr="Official name of the signature." />
      <member type="STRING-SigStringInfo" name="SigStringInfo" important="False" supported="True" descr="Extra information included in the alarm message." />
      <member type="STRING-SigVersion" name="SigVersion" important="True" supported="True" descr="Signature update version of signature" />
      <member type="ENUM(xxxx)-StorageKey-ATOMIC.IPOPTIONS" name="StorageKey" important="True" supported="True" descr="Type of Address Key used to store persistent data." required="yes" default="xxxx" />
      <member type="NUMBER(0-255)-SubSig" name="SubSig" important="True" supported="True" descr="Sub-Signature ID.  Denotes a specific variant of a signature." default="0" key="true" />
      <member type="ENUM(xxxx)-SummaryKey-ATOMIC.IPOPTIONS" name="SummaryKey" important="False" supported="True" descr="The Storage Type on which to summarize this signature." required="yes" default="xxxx" />
      <member type="NUMBER(0-1000)-ThrottleInterval" name="ThrottleInterval" important="False" supported="True" descr="Number of seconds defining an Alarm Throttle interval.  This is used with the AlarmThrottle parameter to tune special alarm limiters." default="30" />
      <member type="ENUM(True,False)-WantFrag" name="WantFrag" important="True" supported="True" descr="True if a fragment is desired.  False if a fragment is not desired.  Any for either." />
    </tArray>
    <tStruct typeName="ATOMIC.IPOPTIONS" SigMemory="5087">
      <member type="Version" name="version" descr="Engine Version" />
      <member type="ATOMIC.IPOPTIONS-Signatures" name="signatures" descr="Simple L3 Alarms based on Ip Options" />
    </tStruct>
    <tString typeName="STRING-DstIpAddr-ATOMIC.L3.IP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tString typeName="STRING-DstIpMask-ATOMIC.L3.IP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tEnum typeName="ENUM(True,False)-isIcmp-ATOMIC.L3.IP" min="1" max="1">
      <value name="True" descr="Set value to true." />
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tEnum typeName="ENUM(True,False)-isImpossiblePacket-ATOMIC.L3.IP" min="1" max="1">
      <value name="True" descr="Set value to true." />
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tEnum typeName="ENUM(True,False)-isLocalhost-ATOMIC.L3.IP" min="1" max="1">
      <value name="True" descr="Set value to true." />
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tEnum typeName="ENUM(True,False)-isOverrun-ATOMIC.L3.IP" min="1" max="1">
      <value name="True" descr="Set value to true." />
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tEnum typeName="ENUM(True,False)-isRFC1918-ATOMIC.L3.IP" min="1" max="1">
      <value name="True" descr="Set value to true." />
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tInteger typeName="NUMBER(0-65535)-MaxDataLen-ATOMIC.L3.IP" min="0" max="65535" type="unsigned" />
    <tInteger typeName="NUMBER(0-255)-MaxProto-ATOMIC.L3.IP" min="0" max="255" type="unsigned" />
    <tInteger typeName="NUMBER(0-65535)-MinDataLen-ATOMIC.L3.IP" min="0" max="65535" type="unsigned" />
    <tInteger typeName="NUMBER(0-255)-MinProto-ATOMIC.L3.IP" min="0" max="255" type="unsigned" />
    <tEnum typeName="ENUM(IP)-Protocol-ATOMIC.L3.IP" min="1" max="1">
      <value name="IP" descr="Interested in L3 IP protocol" />
    </tEnum>
    <tInteger typeName="NUMBER(0-255)-ProtoNum-ATOMIC.L3.IP" min="0" max="255" type="unsigned" />
    <tString typeName="STRING-SrcIpAddr-ATOMIC.L3.IP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tString typeName="STRING-SrcIpMask-ATOMIC.L3.IP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tEnum typeName="ENUM(xxxx)-StorageKey-ATOMIC.L3.IP" min="1" max="1">
      <value name="xxxx" descr="Interested in GLOBAL (all addresses wildcarded) storage" />
    </tEnum>
    <tEnum typeName="ENUM(xxxx)-SummaryKey-ATOMIC.L3.IP" min="1" max="1">
      <value name="xxxx" descr="Summarization groupings on all addresses" />
    </tEnum>
    <tArray typeName="ATOMIC.L3.IP-Signatures" max="1000">
      <member type="AlarmDelayTimer" name="AlarmDelayTimer" important="False" supported="False" descr="Number of seconds to delay further signature inspection after an alarm." />
      <member type="NUMBER(2-1000)-AlarmInterval" name="AlarmInterval" important="False" supported="True" descr="Special Handling for timed events.  Use AlarmInterval Y with MinHits X for X alarms in Y second interval." />
      <member type="ENUM(high,informational,low,medium)-AlarmSeverity" name="AlarmSeverity" important="True" supported="True" descr="The severity of this alert reported in the alarm." default="medium" />
      <member type="ENUM(FireAll,GlobalSummarize)-AlarmThrottle" name="AlarmThrottle" important="False" supported="True" descr="Technique used to limit alarm firings." default="FireAll" />
      <member type="NUMBER(0-65535)-AlarmTraits" name="AlarmTraits" important="False" supported="True" descr="User-defined traits further describing this signature." />
      <member type="ENUM(True,False)-CapturePacket" name="CapturePacket" important="False" supported="False" descr="Set to True to include the offending packet in the alarm." default="False" />
      <member type="NUMBER(0-65535)-ChokeThreshold" name="ChokeThreshold" important="False" supported="True" descr="Threshold value of alarms-per-interval to auto-switch AlarmThrottle modes. If ChokeThreshold is defined the sensor will automatically switch AlarmThrottle modes when a large volume of alarms is seen in the ThrottleInterval." default="100" />
      <member type="STRING-DstIpAddr-ATOMIC.L3.IP" name="DstIpAddr" important="False" supported="False" descr="IP address (or network) to match on the IP packet's destination address. Must be used with DstIpMask." />
      <member type="STRING-DstIpMask-ATOMIC.L3.IP" name="DstIpMask" important="False" supported="False" descr="IP netmask used with DstIpAddr to match on the IP packet's destination address. Must be used with DstIpAddr." />
      <member type="ENUM(True,False)-Enabled" name="Enabled" important="True" supported="True" descr="True to Enable the Sig. False to Disable the Sig." required="yes" default="True" />
      <member type="ENUM(alarm,drop,reset,denyAttackerInline,denyFlowInline)-EventAction" name="EventAction" important="True" supported="True" descr="What action(s) to perform when the alarm is fired." default="alarm" />
      <member type="ENUM(True,False)-FlipAddr" name="FlipAddr" important="True" supported="True" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)." />
      <member type="ENUM(True,False)-isIcmp-ATOMIC.L3.IP" name="isIcmp" important="True" supported="True" descr="Examine ICMP packets only?" />
      <member type="ENUM(True,False)-isImpossiblePacket-ATOMIC.L3.IP" name="isImpossiblePacket" important="True" supported="True" descr="Source IP equals Destination IP." />
      <member type="ENUM(True,False)-isLocalhost-ATOMIC.L3.IP" name="isLocalhost" important="True" supported="True" descr="Localhost (127.0.0.1) is seen in IP packet." />
      <member type="ENUM(True,False)-isOverrun-ATOMIC.L3.IP" name="isOverrun" important="True" supported="True" descr="Is a Fragment Overrun?" />
      <member type="ENUM(True,False)-isRFC1918-ATOMIC.L3.IP" name="isRFC1918" important="True" supported="True" descr="Is a reserved (RFC1918) IP Address?" />
      <member type="NUMBER(0-65535)-MaxDataLen-ATOMIC.L3.IP" name="MaxDataLen" important="True" supported="True" descr="IP data length greater than this will cause alarm." />
      <member type="NUMBER(0-65535)-MaxInspectLength-ATOMIC.L3.IP" name="MaxInspectLength" important="False" supported="False" descr="Maximum number of bytes to inspect." />
      <member type="NUMBER(0-255)-MaxProto-ATOMIC.L3.IP" name="MaxProto" important="True" supported="True" descr="IP Protocol Numbers greater than this will cause alarm." />
      <member type="NUMBER(0-1000)-MaxTTL-ATOMIC.L3.IP" name="MaxTTL" important="False" supported="False" descr="Maximum number of seconds to inspect a logical stream. The inspector is deleted after X seconds of being active." />
      <member type="NUMBER(0-65535)-MinDataLen-ATOMIC.L3.IP" name="MinDataLen" important="True" supported="True" descr="IP data length less than this will cause alarm." />
      <member type="NUMBER(0-65535)-MinHits" name="MinHits" important="False" supported="True" descr="Minimum number of signature hits before the alarm message is sent.  This a limitter for firing the alarm only after X times of seeing the signature on the address key." />
      <member type="NUMBER(0-255)-MinProto-ATOMIC.L3.IP" name="MinProto" important="True" supported="True" descr="IP Protocol Numbers less than this will cause alarm." />
      <member type="ENUM(IP)-Protocol-ATOMIC.L3.IP" name="Protocol" important="False" supported="True" descr="Protocol of interest for this inspector." required="yes" default="IP" />
      <member type="NUMBER(0-255)-ProtoNum-ATOMIC.L3.IP" name="ProtoNum" important="True" supported="True" descr="A single IP Protocol Number to alarm on." />
      <member type="NUMBER(2-1000)-ResetAfterIdle" name="ResetAfterIdle" important="False" supported="False" descr="Number of seconds to wait to reset signature counters after the host(s) were idle." default="15" />
      <member type="STRING-SigComment" name="SigComment" important="False" supported="True" descr="USER NOTES - miscellaneous information about this signature." />
      <member type="NUMBER(993-50000)-SIGID" name="SIGID" important="True" supported="True" descr="Signature Identifier. 993-19999 valid for default signatures. 20000-50000 valid for user signatures.where parameter" required="yes" key="true" />
      <member type="STRING-SigName" name="SigName" important="True" supported="True" descr="Official name of the signature." />
      <member type="STRING-SigStringInfo" name="SigStringInfo" important="False" supported="True" descr="Extra information included in the alarm message." />
      <member type="STRING-SigVersion" name="SigVersion" important="True" supported="True" descr="Signature update version of signature" />
      <member type="STRING-SrcIpAddr-ATOMIC.L3.IP" name="SrcIpAddr" important="False" supported="False" descr="IP address (or network) to match on the IP packet's source address. Must be used with SrcIpMask." />
      <member type="STRING-SrcIpMask-ATOMIC.L3.IP" name="SrcIpMask" important="False" supported="False" descr="IP netmask used with SrcIpAddr to match on the IP packet's destination address. Must be used with SrcIpAddr." />
      <member type="ENUM(xxxx)-StorageKey-ATOMIC.L3.IP" name="StorageKey" important="True" supported="True" descr="Type of Address Key used to store persistent data." required="yes" default="xxxx" />
      <member type="NUMBER(0-255)-SubSig" name="SubSig" important="True" supported="True" descr="Sub-Signature ID.  Denotes a specific variant of a signature." default="0" key="true" />
      <member type="ENUM(xxxx)-SummaryKey-ATOMIC.L3.IP" name="SummaryKey" important="False" supported="True" descr="The Storage Type on which to summarize this signature." required="yes" default="xxxx" />
      <member type="NUMBER(0-1000)-ThrottleInterval" name="ThrottleInterval" important="False" supported="True" descr="Number of seconds defining an Alarm Throttle interval.  This is used with the AlarmThrottle parameter to tune special alarm limiters." default="30" />
      <member type="ENUM(True,False)-WantFrag" name="WantFrag" important="True" supported="True" descr="True if a fragment is desired.  False if a fragment is not desired.  Any for either." />
    </tArray>
    <tStruct typeName="ATOMIC.L3.IP" SigMemory="4815">
      <member type="Version" name="version" descr="Engine Version" />
      <member type="ATOMIC.L3.IP-Signatures" name="signatures" descr="Simple L3 IP Alarms." />
    </tStruct>
    <tString typeName="STRING-DstIpAddr-ATOMIC.TCP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tString typeName="STRING-DstIpMask-ATOMIC.TCP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tInteger typeName="NUMBER(0-65535)-DstPort-ATOMIC.TCP" min="0" max="65535" type="unsigned" />
    <tEnum typeName="ENUM(FIN,SYN,RST,PSH,ACK,URG,ZERO)-Mask-ATOMIC.TCP" min="1" max="7">
      <value name="FIN" descr="FIN bit is 1" />
      <value name="SYN" descr="SYN bit is 1" />
      <value name="RST" descr="RST bit is 1" />
      <value name="PSH" descr="PSH bit is 1" />
      <value name="ACK" descr="ACK bit is 1" />
      <value name="URG" descr="URG bit is 1" />
      <value name="ZERO" descr="none of the bits are 1" />
    </tEnum>
    <tInteger typeName="NUMBER(0-2)-PortRange-ATOMIC.TCP" min="0" max="2" type="unsigned" />
    <tInteger typeName="NUMBER(0-2)-PortRangeSource-ATOMIC.TCP" min="0" max="2" type="unsigned" />
    <tEnum typeName="ENUM(TCP)-Protocol-ATOMIC.TCP" min="1" max="1">
      <value name="TCP" descr="Interested in L4 TCP protocol" />
    </tEnum>
    <tString typeName="STRING-SrcIpAddr-ATOMIC.TCP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tString typeName="STRING-SrcIpMask-ATOMIC.TCP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tInteger typeName="NUMBER(0-65535)-SrcPort-ATOMIC.TCP" min="0" max="65535" type="unsigned" />
    <tString typeName="STRING-SinglePacketRegex-ATOMIC.TCP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tEnum typeName="ENUM(xxxx)-StorageKey-ATOMIC.TCP" min="1" max="1">
      <value name="xxxx" descr="Interested in GLOBAL (all addresses wildcarded) storage" />
    </tEnum>
    <tEnum typeName="ENUM(xxxx)-SummaryKey-ATOMIC.TCP" min="1" max="1">
      <value name="xxxx" descr="Summarization groupings on all addresses" />
    </tEnum>
    <tEnum typeName="ENUM(FIN,SYN,RST,PSH,ACK,URG,ZERO)-TcpFlags-ATOMIC.TCP" min="1" max="7">
      <value name="FIN" descr="FIN bit is 1" />
      <value name="SYN" descr="SYN bit is 1" />
      <value name="RST" descr="RST bit is 1" />
      <value name="PSH" descr="PSH bit is 1" />
      <value name="ACK" descr="ACK bit is 1" />
      <value name="URG" descr="URG bit is 1" />
      <value name="ZERO" descr="none of the bits are 1" />
    </tEnum>
    <tArray typeName="ATOMIC.TCP-Signatures" max="1000">
      <member type="AlarmDelayTimer" name="AlarmDelayTimer" important="False" supported="False" descr="Number of seconds to delay further signature inspection after an alarm." />
      <member type="NUMBER(2-1000)-AlarmInterval" name="AlarmInterval" important="False" supported="True" descr="Special Handling for timed events.  Use AlarmInterval Y with MinHits X for X alarms in Y second interval." />
      <member type="ENUM(high,informational,low,medium)-AlarmSeverity" name="AlarmSeverity" important="True" supported="True" descr="The severity of this alert reported in the alarm." default="medium" />
      <member type="ENUM(FireAll,GlobalSummarize)-AlarmThrottle" name="AlarmThrottle" important="False" supported="True" descr="Technique used to limit alarm firings." default="FireAll" />
      <member type="NUMBER(0-65535)-AlarmTraits" name="AlarmTraits" important="False" supported="True" descr="User-defined traits further describing this signature." />
      <member type="ENUM(True,False)-CapturePacket" name="CapturePacket" important="False" supported="False" descr="Set to True to include the offending packet in the alarm." default="False" />
      <member type="NUMBER(0-65535)-ChokeThreshold" name="ChokeThreshold" important="False" supported="True" descr="Threshold value of alarms-per-interval to auto-switch AlarmThrottle modes. If ChokeThreshold is defined the sensor will automatically switch AlarmThrottle modes when a large volume of alarms is seen in the ThrottleInterval." default="100" />
      <member type="STRING-DstIpAddr-ATOMIC.TCP" name="DstIpAddr" important="False" supported="False" descr="IP address (or network) to match on the IP packet's destination address. Must be used with DstIpMask." />
      <member type="STRING-DsrIpMask-ATOMIC.TCP" name="DstIpMask" important="False" supported="False" descr="IP netmask used with DstIpAddr to match on the IP packet's destination address. Must be used with DstIpAddr." />
      <member type="NUMBER(0-65535)-DstPort-ATOMIC.TCP" name="DstPort" important="True" supported="True" descr="A single Destination Port to match." />
      <member type="ENUM(True,False)-Enabled" name="Enabled" important="True" supported="True" descr="True to Enable the Sig. False to Disable the Sig." required="yes" default="True" />
      <member type="ENUM(alarm,drop,reset,denyAttackerInline,denyFlowInline)-EventAction" name="EventAction" important="True" supported="True" descr="What action(s) to perform when the alarm is fired." default="alarm" />
      <member type="ENUM(True,False)-FlipAddr" name="FlipAddr" important="True" supported="True" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)." />
      <member type="ENUM(FIN,SYN,RST,PSH,ACK,URG,ZERO)-Mask-ATOMIC.TCP" name="Mask" important="True" supported="True" descr="Mask used in TcpFlags comparison." required="yes" />
      <member type="NUMBER(0-65535)-MaxInspectLength" name="MaxInspectLength" important="False" supported="False" descr="Maximum number of bytes to inspect." />
      <member type="NUMBER(0-1000)-MaxTTL" name="MaxTTL" important="False" supported="False" descr="Maximum number of seconds to inspect a logical stream. The inspector is deleted after X seconds of being active." />
      <member type="NUMBER(0-65535)-MinHits" name="MinHits" important="False" supported="True" descr="Minimum number of signature hits before the alarm message is sent.  This a limitter for firing the alarm only after X times of seeing the signature on the address key." />
      <member type="NUMBER(0-2)-PortRange-ATOMIC.TCP" name="PortRange" important="True" supported="True" descr="Dest port: Only Low Ports (1), Only High Ports (2), or All (0)" />
      <member type="NUMBER(0-2)-PortRangeSource-ATOMIC.TCP" name="PortRangeSource" important="True" supported="True" descr="Source port: Only Low Ports (1), Only High Ports (2), or All (0)" />
      <member type="ENUM(TCP)-Protocol-ATOMIC.TCP" name="Protocol" important="True" supported="True" descr="Protocol of interest for this inspector." required="yes" default="TCP" />
      <member type="NUMBER(2-1000)-ResetAfterIdle" name="ResetAfterIdle" important="False" supported="False" descr="Number of seconds to wait to reset signature counters after the host(s) were idle." default="15" />
      <member type="STRING-SigComment" name="SigComment" important="False" supported="True" descr="USER NOTES - miscellaneous information about this signature." />
      <member type="NUMBER(993-50000)-SIGID" name="SIGID" important="True" supported="True" descr="Signature Identifier. 993-19999 valid for default signatures. 20000-50000 valid for user signatures.where parameter" required="yes" key="true" />
      <member type="STRING-SigName" name="SigName" important="True" supported="True" descr="Official name of the signature." />
      <member type="STRING-SigStringInfo" name="SigStringInfo" important="False" supported="True" descr="Extra information included in the alarm message." />
      <member type="STRING-SigVersion" name="SigVersion" important="True" supported="True" descr="Signature update version of signature" />
      <member type="STRING-SinglePacketRegex-ATOMIC.TCP" name="SinglePacketRegex" important="True" supported="True" descr="A regular expression to search for in a single TCP packet" />
      <member type="STRING-SrcIpAddr-ATOMIC.TCP" name="SrcIpAddr" important="False" supported="False" descr="IP address (or network) to match on the IP packet's source address. Must be used with SrcIpMask." />
      <member type="STRING-SrcIpMask-ATOMIC.TCP" name="SrcIpMask" important="False" supported="False" descr="IP netmask used with SrcIpAddr to match on the IP packet's destination address. Must be used with SrcIpAddr." />
      <member type="NUMBER(0-65535)-SrcPort-ATOMIC.TCP" name="SrcPort" important="True" supported="True" descr="A single Source Port to match." />
      <member type="ENUM(xxxx)-StorageKey-ATOMIC.TCP" name="StorageKey" important="True" supported="True" descr="Type of Address Key used to store persistent data." required="yes" default="xxxx" />
      <member type="NUMBER(0-255)-SubSig" name="SubSig" important="True" supported="True" descr="Sub-Signature ID.  Denotes a specific variant of a signature." default="0" key="true" />
      <member type="ENUM(xxxx)-SummaryKey-ATOMIC.TCP" name="SummaryKey" important="False" supported="True" descr="The Storage Type on which to summarize this signature." required="yes" default="xxxx" />
      <member type="ENUM(FIN,SYN,RST,PSH,ACK,URG,ZERO)-TcpFlags-ATOMIC.TCP" name="TcpFlags" important="True" supported="True" descr="TCP Flags to match when masked by Mask." required="yes" />
      <member type="NUMBER(0-1000)-ThrottleInterval" name="ThrottleInterval" important="False" supported="True" descr="Number of seconds defining an Alarm Throttle interval.  This is used with the AlarmThrottle parameter to tune special alarm limiters." default="30" />
      <member type="ENUM(True,False)-WantFrag" name="WantFrag" important="True" supported="True" descr="True if a fragment is desired.  False if a fragment is not desired.  Any for either." />
    </tArray>
    <tStruct typeName="ATOMIC.TCP" SigMemory="49445">
      <member type="Version" name="version" descr="Engine Version" />
      <member type="ATOMIC.TCP-Signatures" name="signatures" descr="Simple TCP packet alarms based on TCP Flags, ports (both sides), and single packet regex.  Use SummaryKey to define the address view for MinHits and Summarize counting.  For best performance, use a StorageKey of xxxx." />
    </tStruct>
    <tString typeName="STRING-DstIpAddr-ATOMIC.UDP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tString typeName="STRING-DstIpMask-ATOMIC.UDP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tInteger typeName="NUMBER(0-65535)-DstPort-ATOMIC.UDP" min="0" max="65535" type="unsigned" />
    <tInteger typeName="NUMBER(0-65535)-MinUDPLength-ATOMIC.UDP" min="0" max="65535" type="unsigned" />
    <tEnum typeName="ENUM(UDP)-Protocol-ATOMIC.UDP" min="1" max="1">
      <value name="UDP" descr="Interested in L4 UDP protocol" />
    </tEnum>
    <tEnum typeName="ENUM(True,False)-ShortUDPLength-ATOMIC.UDP" min="1" max="1">
      <value name="True" descr="Set value to true." />
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tString typeName="STRING-SrcIpAddr-ATOMIC.UDP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tString typeName="STRING-SrcIpMask-ATOMIC.UDP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tInteger typeName="NUMBER(0-65535)-SrcPort-ATOMIC.UDP" min="0" max="65535" type="unsigned" />
    <tEnum typeName="ENUM(xxxx)-StorageKey-ATOMIC.UDP" min="1" max="1">
      <value name="xxxx" descr="Interested in GLOBAL (all addresses wildcarded) storage" />
    </tEnum>
    <tEnum typeName="ENUM(xxxx)-SummaryKey-ATOMIC.UDP" min="1" max="1">
      <value name="xxxx" descr="Summarization groupings on all addresses" />
    </tEnum>
    <tArray typeName="ATOMIC.UDP-Signatures" max="1000">
      <member type="AlarmDelayTimer" name="AlarmDelayTimer" important="False" supported="False" descr="Number of seconds to delay further signature inspection after an alarm." />
      <member type="NUMBER(2-1000)-AlarmInterval" name="AlarmInterval" important="False" supported="True" descr="Special Handling for timed events.  Use AlarmInterval Y with MinHits X for X alarms in Y second interval." />
      <member type="ENUM(high,informational,low,medium)-AlarmSeverity" name="AlarmSeverity" important="True" supported="True" descr="The severity of this alert reported in the alarm." default="medium" />
      <member type="ENUM(FireAll,GlobalSummarize)-AlarmThrottle" name="AlarmThrottle" important="False" supported="True" descr="Technique used to limit alarm firings." default="FireAll" />
      <member type="NUMBER(0-65535)-AlarmTraits" name="AlarmTraits" important="False" supported="True" descr="User-defined traits further describing this signature." />
      <member type="ENUM(True,False)-CapturePacket" name="CapturePacket" important="False" supported="False" descr="Set to True to include the offending packet in the alarm." default="False" />
      <member type="NUMBER(0-65535)-ChokeThreshold" name="ChokeThreshold" important="False" supported="True" descr="Threshold value of alarms-per-interval to auto-switch AlarmThrottle modes. If ChokeThreshold is defined the sensor will automatically switch AlarmThrottle modes when a large volume of alarms is seen in the ThrottleInterval." default="100" />
      <member type="STRING-DstIpAddr-ATOMIC.UDP" name="DstIpAddr" important="False" supported="False" descr="IP address (or network) to match on the IP packet's destination address. Must be used with DstIpMask." />
      <member type="STRING-DstIpMask-ATOMIC.UDP" name="DstIpMask" important="False" supported="False" descr="IP netmask used with DstIpAddr to match on the IP packet's destination address. Must be used with DstIpAddr." />
      <member type="NUMBER(0-65535)-DstPort-ATOMIC.UDP" name="DstPort" important="True" supported="True" descr="A single Destination Port to match." />
      <member type="ENUM(True,False)-Enabled" name="Enabled" important="True" supported="True" descr="True to Enable the Sig. False to Disable the Sig." required="yes" default="True" />
      <member type="ENUM(alarm,drop,reset,denyAttackerInline,denyFlowInline)-EventAction" name="EventAction" important="True" supported="True" descr="What action(s) to perform when the alarm is fired." default="alarm" />
      <member type="ENUM(True,False)-FlipAddr" name="FlipAddr" important="True" supported="True" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)." />
      <member type="NUMBER(0-65535)-MaxInspectLength" name="MaxInspectLength" important="False" supported="False" descr="Maximum number of bytes to inspect." />
      <member type="NUMBER(0-1000)-MaxTTL" name="MaxTTL" important="False" supported="False" descr="Maximum number of seconds to inspect a logical stream. The inspector is deleted after X seconds of being active." />
      <member type="NUMBER(0-65535)-MinHits" name="MinHits" important="False" supported="True" descr="Minimum number of signature hits before the alarm message is sent.  This a limitter for firing the alarm only after X times of seeing the signature on the address key." />
      <member type="NUMBER(0-65535)-MinUDPLength-ATOMIC.UDP" name="MinUDPLength" important="True" supported="True" descr="Fire alarm when packet UDP LENGTH is less than this." />
      <member type="ENUM(UDP)-Protocol-ATOMIC.UDP" name="Protocol" important="True" supported="True" descr="Protocol of interest for this inspector." required="yes" default="UDP" />
      <member type="NUMBER(2-1000)-ResetAfterIdle" name="ResetAfterIdle" important="False" supported="False" descr="Number of seconds to wait to reset signature counters after the host(s) were idle." default="15" />
      <member type="ENUM(True,False)-ShortUDPLength-ATOMIC.UDP" name="ShortUDPLength" important="True" supported="True" descr="Fire alarm when IP Data length is less than UDP Header Length" />
      <member type="STRING-SigComment" name="SigComment" important="False" supported="True" descr="USER NOTES - miscellaneous information about this signature." />
      <member type="NUMBER(993-50000)-SIGID" name="SIGID" important="True" supported="True" descr="Signature Identifier. 993-19999 valid for default signatures. 20000-50000 valid for user signatures.where parameter" required="yes" key="true" />
      <member type="STRING-SigName" name="SigName" important="True" supported="True" descr="Official name of the signature." />
      <member type="STRING-SigStringInfo" name="SigStringInfo" important="False" supported="True" descr="Extra information included in the alarm message." />
      <member type="STRING-SigVersion" name="SigVersion" important="True" supported="True" descr="Signature update version of signature" />
      <member type="STRING-SrcIpAddr-ATOMIC.UDP" name="SrcIpAddr" important="False" supported="False" descr="IP address (or network) to match on the IP packet's source address. Must be used with SrcIpMask." />
      <member type="STRING-SrcIpMask-ATOMIC.UDP" name="SrcIpMask" important="False" supported="False" descr="IP netmask used with SrcIpAddr to match on the IP packet's destination address. Must be used with SrcIpAddr." />
      <member type="NUMBER(0-65535)-SrcPort-ATOMIC.UDP" name="SrcPort" important="True" supported="True" descr="A single Source Port to match." />
      <member type="ENUM(xxxx)-StorageKey-ATOMIC.UDP" name="StorageKey" important="True" supported="True" descr="Type of Address Key used to store persistent data." required="yes" default="xxxx" />
      <member type="NUMBER(0-255)-SubSig" name="SubSig" important="True" supported="True" descr="Sub-Signature ID.  Denotes a specific variant of a signature." default="0" key="true" />
      <member type="ENUM(xxxx)-SummaryKey-ATOMIC.UDP" name="SummaryKey" important="False" supported="True" descr="The Storage Type on which to summarize this signature." required="yes" default="xxxx" />
      <member type="NUMBER(0-1000)-ThrottleInterval" name="ThrottleInterval" important="False" supported="True" descr="Number of seconds defining an Alarm Throttle interval.  This is used with the AlarmThrottle parameter to tune special alarm limiters." default="30" />
      <member type="ENUM(True,False)-WantFrag" name="WantFrag" important="True" supported="True" descr="True if a fragment is desired.  False if a fragment is not desired.  Any for either." />
    </tArray>
    <tStruct typeName="ATOMIC.UDP" SigMemory="6866">
      <member type="Version" name="version" descr="Engine Version" />
      <member type="ATOMIC.UDP-Signatures" name="signatures" descr="Simple UDP packet alarms based on Port, Direction and DataLength." />
    </tStruct>
    <tEnum typeName="ENUM(FRAG,TCP)-Protocol-OTHER" min="1" max="1">
      <value name="FRAG" descr="Interested in Fragments" />
      <value name="TCP" descr="Interested in L4 TCP protocol" />
    </tEnum>
    <tEnum typeName="ENUM(xxxx,AxBx)-StorageKey-OTHER" min="1" max="1">
      <value name="xxxx" descr="Interested in GLOBAL (all addresses wildcarded) storage" />
      <value name="AxBx" descr="Interested in source and dest address pair groupings direction sensitive" />
    </tEnum>
    <tEnum typeName="ENUM(xxxx)-SummaryKey-OTHER" min="1" max="1">
      <value name="xxxx" descr="Summarization groupings on all addresses" />
    </tEnum>
    <tArray typeName="OTHER-Signatures" max="9">
      <member type="AlarmDelayTimer" name="AlarmDelayTimer" important="False" supported="False" descr="Number of seconds to delay further signature inspection after an alarm." />
      <member type="NUMBER(2-1000)-AlarmInterval" name="AlarmInterval" important="False" supported="True" descr="Special Handling for timed events.  Use AlarmInterval Y with MinHits X for X alarms in Y second interval." />
      <member type="ENUM(high,informational,low,medium)-AlarmSeverity" name="AlarmSeverity" important="True" supported="True" descr="The severity of this alert reported in the alarm." default="medium" />
      <member type="ENUM(FireAll,GlobalSummarize)-AlarmThrottle" name="AlarmThrottle" important="False" supported="True" descr="Technique used to limit alarm firings." default="FireAll" />
      <member type="NUMBER(0-65535)-AlarmTraits" name="AlarmTraits" important="False" supported="True" descr="User-defined traits further describing this signature." />
      <member type="ENUM(True,False)-CapturePacket" name="CapturePacket" important="False" supported="False" descr="Set to True to include the offending packet in the alarm." default="False" />
      <member type="NUMBER(0-65535)-ChokeThreshold" name="ChokeThreshold" important="False" supported="True" descr="Threshold value of alarms-per-interval to auto-switch AlarmThrottle modes. If ChokeThreshold is defined the sensor will automatically switch AlarmThrottle modes when a large volume of alarms is seen in the ThrottleInterval." default="100" />
      <member type="ENUM(True,False)-Enabled" name="Enabled" important="True" supported="True" descr="True to Enable the Sig. False to Disable the Sig." required="yes" default="True" />
      <member type="ENUM(alarm,drop,reset,denyAttackerInline,denyFlowInline)-EventAction" name="EventAction" important="True" supported="True" descr="What action(s) to perform when the alarm is fired." default="alarm" />
      <member type="ENUM(True,False)-FlipAddr" name="FlipAddr" important="True" supported="True" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)." />
      <member type="NUMBER(0-65535)-MaxInspectLength" name="MaxInspectLength" important="False" supported="False" descr="Maximum number of bytes to inspect." />
      <member type="NUMBER(0-1000)-MaxTTL" name="MaxTTL" important="False" supported="False" descr="Maximum number of seconds to inspect a logical stream. The inspector is deleted after X seconds of being active." />
      <member type="NUMBER(0-65535)-MinHits" name="MinHits" important="False" supported="True" descr="Minimum number of signature hits before the alarm message is sent.  This a limitter for firing the alarm only after X times of seeing the signature on the address key." />
      <member type="ENUM(FRAG,TCP)-Protocol-OTHER" name="Protocol" important="True" supported="True" descr="Protocol of interest for this inspector." required="yes" />
      <member type="NUMBER(2-1000)-ResetAfterIdle" name="ResetAfterIdle" important="False" supported="False" descr="Number of seconds to wait to reset signature counters after the host(s) were idle." default="15" />
      <member type="STRING-SigComment" name="SigComment" important="False" supported="True" descr="USER NOTES - miscellaneous information about this signature." />
      <member type="NUMBER(993-50000)-SIGID" name="SIGID" important="True" supported="True" descr="Signature Identifier. 993-19999 valid for default signatures. 20000-50000 valid for user signatures.where parameter" required="yes" key="true" />
      <member type="STRING-SigName" name="SigName" important="True" supported="True" descr="Official name of the signature." />
      <member type="STRING-SigStringInfo" name="SigStringInfo" important="False" supported="True" descr="Extra information included in the alarm message." />
      <member type="STRING-SigVersion" name="SigVersion" important="True" supported="True" descr="Signature update version of signature" />
      <member type="ENUM(xxxx,AxBx)-StorageKey-OTHER" name="StorageKey" important="True" supported="True" descr="Type of Address Key used to store persistent data." required="yes" default="xxxx" />
      <member type="NUMBER(0-255)-SubSig" name="SubSig" important="True" supported="True" descr="Sub-Signature ID.  Denotes a specific variant of a signature." default="0" key="true" />
      <member type="ENUM(xxxx)-SummaryKey-OTHER" name="SummaryKey" important="False" supported="True" descr="The Storage Type on which to summarize this signature." required="yes" default="xxxx" />
      <member type="NUMBER(0-1000)-ThrottleInterval" name="ThrottleInterval" important="False" supported="True" descr="Number of seconds defining an Alarm Throttle interval.  This is used with the AlarmThrottle parameter to tune special alarm limiters." default="30" />
      <member type="ENUM(True,False)-WantFrag" name="WantFrag" important="True" supported="True" descr="True if a fragment is desired.  False if a fragment is not desired.  Any for either." />
    </tArray>
    <tArray typeName="OTHER-IOS-Supported-Signatures" max="9">
      <member type="NUMBER(993-50000)-SIGID" name="SIGID" required="yes" key="true" />
      <member type="NUMBER(0-255)-SubSig" name="SubSig" default="0" key="true" />
    </tArray>
    <tStruct typeName="OTHER" SigMemory="4291">
      <member type="Version" name="version" descr="Engine Version" />
      <member type="OTHER-Signatures" name="signatures" descr="This engine is used to group generic signatures so common parameters may be changed.  It defines an interface into common signature parameters.." />
      <member type="OTHER-IOS-Supported-Signatures" name="IOS-supported-signatures" descr="This engine is used to group generic signatures so common parameters may be changed.  It defines an interface into common signature parameters.." />
    </tStruct>
    <tEnum typeName="ENUM(TCP,UDP)-Protocol-SERVICE.DNS" min="1" max="1">
      <value name="TCP" descr="Interested in L4 TCP protocol" />
      <value name="UDP" descr="Interested in L4 UDP protocol" />
    </tEnum>
    <tString typeName="STRING-QueryChaosString-SERVICE.DNS" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tInteger typeName="NUMBER(0-65535)-QueryClass-SERVICE.DNS" min="0" max="65535" type="unsigned" />
    <tEnum typeName="ENUM(True,False)-QueryInvalidDomainName-SERVICE.DNS" min="1" max="1">
      <value name="True" descr="Set value to true." />
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tEnum typeName="ENUM(True,False)-QueryJumpCountExceeded-SERVICE.DNS" min="1" max="1">
      <value name="True" descr="Set value to true." />
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tInteger typeName="NUMBER(0-255)-QueryOpcode-SERVICE.DNS" min="0" max="255" type="unsigned" />
    <tEnum typeName="ENUM(True,False)-QueryRecordDataInvalid-SERVICE.DNS" min="1" max="1">
      <value name="True" descr="Set value to true." />
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tInteger typeName="NUMBER(0-65535)-QueryRecordDataLen-SERVICE.DNS" min="0" max="65535" type="unsigned" />
    <tEnum typeName="ENUM(True,False)-QuerySrcPort53-SERVICE.DNS" min="1" max="1">
      <value name="True" descr="Set value to true." />
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tInteger typeName="NUMBER(0-65535)-QueryStreamLen-SERVICE.DNS" min="0" max="65535" type="unsigned" />
    <tInteger typeName="NUMBER(0-65535)-QueryType-SERVICE.DNS" min="0" max="65535" type="unsigned" />
    <tEnum typeName="ENUM(True,False)-QueryValue-SERVICE.DNS" min="1" max="1">
      <value name="True" descr="Set value to true." />
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tEnum typeName="ENUM(xxxx,AaBb,STREAM)-StorageKey-SERVICE.DNS" min="1" max="1">
      <value name="xxxx" descr="Interested in GLOBAL (all addresses wildcarded) storage" />
      <value name="AaBb" descr="Interested in Connection QUAD groupings" />
      <value name="STREAM" descr="Interested in reassembled Stream" />
    </tEnum>
    <tEnum typeName="ENUM(AaBb)-SummaryKey-SERVICE.DNS" min="1" max="1">
      <value name="AaBb" descr="Summarization groupings on the connection QUAD" />
    </tEnum>
    <tArray typeName="SERVICE.DNS-Signatures" max="1000">
      <member type="AlarmDelayTimer" name="AlarmDelayTimer" important="False" supported="False" descr="Number of seconds to delay further signature inspection after an alarm." />
      <member type="NUMBER(2-1000)-AlarmInterval" name="AlarmInterval" important="False" supported="True" descr="Special Handling for timed events.  Use AlarmInterval Y with MinHits X for X alarms in Y second interval." />
      <member type="ENUM(high,informational,low,medium)-AlarmSeverity" name="AlarmSeverity" important="True" supported="True" descr="The severity of this alert reported in the alarm." default="medium" />
      <member type="ENUM(FireAll,GlobalSummarize)-AlarmThrottle" name="AlarmThrottle" important="False" supported="True" descr="Technique used to limit alarm firings." default="FireAll" />
      <member type="NUMBER(0-65535)-AlarmTraits" name="AlarmTraits" important="False" supported="True" descr="User-defined traits further describing this signature." />
      <member type="ENUM(True,False)-CapturePacket" name="CapturePacket" important="False" supported="False" descr="Set to True to include the offending packet in the alarm." default="False" />
      <member type="NUMBER(0-65535)-ChokeThreshold" name="ChokeThreshold" important="False" supported="True" descr="Threshold value of alarms-per-interval to auto-switch AlarmThrottle modes. If ChokeThreshold is defined the sensor will automatically switch AlarmThrottle modes when a large volume of alarms is seen in the ThrottleInterval." default="100" />
      <member type="ENUM(True,False)-Enabled" name="Enabled" important="True" supported="True" descr="True to Enable the Sig. False to Disable the Sig." required="yes" default="True" />
      <member type="ENUM(alarm,drop,reset,denyAttackerInline,denyFlowInline)-EventAction" name="EventAction" important="True" supported="True" descr="What action(s) to perform when the alarm is fired." default="alarm" />
      <member type="ENUM(True,False)-FlipAddr" name="FlipAddr" important="True" supported="True" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)." />
      <member type="NUMBER(0-65535)-MaxInspectLength" name="MaxInspectLength" important="False" supported="False" descr="Maximum number of bytes to inspect." />
      <member type="NUMBER(0-1000)-MaxTTL" name="MaxTTL" important="False" supported="False" descr="Maximum number of seconds to inspect a logical stream. The inspector is deleted after X seconds of being active." />
      <member type="NUMBER(0-65535)-MinHits" name="MinHits" important="False" supported="True" descr="Minimum number of signature hits before the alarm message is sent.  This a limitter for firing the alarm only after X times of seeing the signature on the address key." />
      <member type="ENUM(TCP,UDP)-Protocol-SERVICE.DNS" name="Protocol" important="True" supported="True" descr="Protocol of interest for this inspector." required="yes" default="UDP" />
      <member type="STRING-QueryChaosString-SERVICE.DNS" name="QueryChaosString" important="True" supported="True" descr="DNS Query Class Chaos String" />
      <member type="NUMBER(0-65535)-QueryClass-SERVICE.DNS" name="QueryClass" important="True" supported="True" descr="DNS Query Class 2 Byte Value" />
      <member type="ENUM(True,False)-QueryInvalidDomainName-SERVICE.DNS" name="QueryInvalidDomainName" important="True" supported="True" descr="DNS Query Length &gt;255" />
      <member type="ENUM(True,False)-QueryJumpCountExceeded-SERVICE.DNS" name="QueryJumpCountExceeded" important="True" supported="True" descr="DNS compression counter" />
      <member type="NUMBER(0-255)-QueryOpcode-SERVICE.DNS" name="QueryOpcode" important="True" supported="True" descr="DNS Query Opcode 1 byte Value" />
      <member type="ENUM(True,False)-QueryRecordDataInvalid-SERVICE.DNS" name="QueryRecordDataInvalid" important="True" supported="True" descr="DNS Record Data incomplete" />
      <member type="NUMBER(0-65535)-QueryRecordDataLen-SERVICE.DNS" name="QueryRecordDataLen" important="True" supported="True" descr="DNS Response Record Data Length" />
      <member type="ENUM(True,False)-QuerySrcPort53-SERVICE.DNS" name="QuerySrcPort53" important="True" supported="True" descr="DNS packet Src Port 53 " />
      <member type="NUMBER(0-65535)-QueryStreamLen-SERVICE.DNS" name="QueryStreamLen" important="True" supported="True" descr="DNS Packet Length" />
      <member type="NUMBER(0-65535)-QueryType-SERVICE.DNS" name="QueryType" important="True" supported="True" descr="DNS Query Type 2 Byte Value" />
      <member type="ENUM(True,False)-QueryValue-SERVICE.DNS" name="QueryValue" important="True" supported="True" descr="Query 0 Response 1" />
      <member type="NUMBER(2-1000)-ResetAfterIdle" name="ResetAfterIdle" important="False" supported="False" descr="Number of seconds to wait to reset signature counters after the host(s) were idle." default="15" />
      <member type="STRING-SigComment" name="SigComment" important="False" supported="True" descr="USER NOTES - miscellaneous information about this signature." />
      <member type="NUMBER(993-50000)-SIGID" name="SIGID" important="True" supported="True" descr="Signature Identifier. 993-19999 valid for default signatures. 20000-50000 valid for user signatures.where parameter" required="yes" key="true" />
      <member type="STRING-SigName" name="SigName" important="True" supported="True" descr="Official name of the signature." />
      <member type="STRING-SigStringInfo" name="SigStringInfo" important="False" supported="True" descr="Extra information included in the alarm message." />
      <member type="STRING-SigVersion" name="SigVersion" important="True" supported="True" descr="Signature update version of signature" />
      <member type="ENUM(xxxx,AaBb,STREAM)-StorageKey-SERVICE.DNS" name="StorageKey" important="True" supported="True" descr="Type of Address Key used to store persistent data." required="yes" default="AaBb" />
      <member type="NUMBER(0-255)-SubSig" name="SubSig" important="True" supported="True" descr="Sub-Signature ID.  Denotes a specific variant of a signature." default="0" key="true" />
      <member type="ENUM(AaBb)-SummaryKey-SERVICE.DNS" name="SummaryKey" important="False" supported="True" descr="The Storage Type on which to summarize this signature." required="yes" default="AaBb" />
      <member type="NUMBER(0-1000)-ThrottleInterval" name="ThrottleInterval" important="False" supported="True" descr="Number of seconds defining an Alarm Throttle interval.  This is used with the AlarmThrottle parameter to tune special alarm limiters." default="30" />
      <member type="ENUM(True,False)-WantFrag" name="WantFrag" important="True" supported="True" descr="True if a fragment is desired.  False if a fragment is not desired.  Any for either." />
    </tArray>
    <tStruct typeName="SERVICE.DNS" SigMemory="6243">
      <member type="Version" name="version" descr="Engine Version" />
      <member type="SERVICE.DNS-Signatures" name="signatures" descr="DNS SERVICE Analysis Engine" />
    </tStruct>
    <tEnum typeName="ENUM(True,False)-BadPortCmdAddress-SERVICE.FTP" min="1" max="1">
      <value name="True" descr="Set value to true." />
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tEnum typeName="ENUM(True,False)-BadPortCmdPort-SERVICE.FTP" min="1" max="1">
      <value name="True" descr="Set value to true." />
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tEnum typeName="ENUM(True,False)-BadPortCmdShort-SERVICE.FTP" min="1" max="1">
      <value name="True" descr="Set value to true." />
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tEnum typeName="ENUM(ToService,FromService)-Direction-SERVICE.FTP" min="1" max="1">
      <value name="ToService" descr="Want only the server-bound side of the conversation" />
      <value name="FromService" descr="Want only the client-bound side of the conversation" />
    </tEnum>
    <tEnum typeName="ENUM(True,False)-isPASV-SERVICE.FTP" min="1" max="1">
      <value name="True" descr="Set value to true." />
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tEnum typeName="ENUM(TCP)-Protocol-SERVICE.FTP" min="1" max="1">
      <value name="TCP" descr="Interested in L4 TCP protocol" />
    </tEnum>
    <tEnum typeName="ENUM(AaBb,STREAM)-StorageKey-SERVICE.FTP" min="1" max="1">
      <value name="AaBb" descr="Interested in Connection QUAD groupings" />
      <value name="STREAM" descr="Interested in reassembled Stream" />
    </tEnum>
    <tEnum typeName="ENUM(AaBb)-SummaryKey-SERVICE.FTP" min="1" max="1">
      <value name="AaBb" descr="Summarization groupings on the connection QUAD" />
    </tEnum>
    <tArray typeName="SERVICE.FTP-Signatures" max="1000">
      <member type="AlarmDelayTimer" name="AlarmDelayTimer" important="False" supported="False" descr="Number of seconds to delay further signature inspection after an alarm." />
      <member type="NUMBER(2-1000)-AlarmInterval" name="AlarmInterval" important="False" supported="True" descr="Special Handling for timed events.  Use AlarmInterval Y with MinHits X for X alarms in Y second interval." />
      <member type="ENUM(high,informational,low,medium)-AlarmSeverity" name="AlarmSeverity" important="True" supported="True" descr="The severity of this alert reported in the alarm." default="medium" />
      <member type="ENUM(FireAll,GlobalSummarize)-AlarmThrottle" name="AlarmThrottle" important="False" supported="True" descr="Technique used to limit alarm firings." default="FireAll" />
      <member type="NUMBER(0-65535)-AlarmTraits" name="AlarmTraits" important="False" supported="True" descr="User-defined traits further describing this signature." />
      <member type="ENUM(True,False)-BadPortCmdAddress-SERVICE.FTP" name="BadPortCmdAddress" important="True" supported="True" descr="Invalid address specified in PORT command" />
      <member type="ENUM(True,False)-BadPortCmdPort-SERVICE.FTP" name="BadPortCmdPort" important="True" supported="True" descr="Invalid port specified in PORT command" />
      <member type="ENUM(True,False)-BadPortCmdShort-SERVICE.FTP" name="BadPortCmdShort" important="True" supported="True" descr="PORT command malformed (Short)." />
      <member type="ENUM(True,False)-CapturePacket" name="CapturePacket" important="False" supported="False" descr="Set to True to include the offending packet in the alarm." default="False" />
      <member type="NUMBER(0-65535)-ChokeThreshold" name="ChokeThreshold" important="False" supported="True" descr="Threshold value of alarms-per-interval to auto-switch AlarmThrottle modes. If ChokeThreshold is defined the sensor will automatically switch AlarmThrottle modes when a large volume of alarms is seen in the ThrottleInterval." default="100" />
      <member type="ENUM(ToService,FromService)-Direction-SERVICE.FTP" name="Direction" important="True" supported="True" descr="One of `ToService` or `FromService` indicating whether we are watching traffic destined to or coming from the service port" default="ToService" />
      <member type="ENUM(True,False)-Enabled" name="Enabled" important="True" supported="True" descr="True to Enable the Sig. False to Disable the Sig." required="yes" default="True" />
      <member type="ENUM(alarm,drop,reset,denyAttackerInline,denyFlowInline)-EventAction" name="EventAction" important="True" supported="True" descr="What action(s) to perform when the alarm is fired." default="alarm" />
      <member type="ENUM(True,False)-FlipAddr" name="FlipAddr" important="True" supported="True" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)." />
      <member type="ENUM(True,False)-isPASV-SERVICE.FTP" name="isPASV" important="True" supported="True" descr="PASV port spoof was detected" />
      <member type="NUMBER(0-65535)-MaxInspectLength" name="MaxInspectLength" important="False" supported="False" descr="Maximum number of bytes to inspect." />
      <member type="NUMBER(0-1000)-MaxTTL" name="MaxTTL" important="False" supported="False" descr="Maximum number of seconds to inspect a logical stream. The inspector is deleted after X seconds of being active." />
      <member type="NUMBER(0-65535)-MinHits" name="MinHits" important="False" supported="True" descr="Minimum number of signature hits before the alarm message is sent.  This a limitter for firing the alarm only after X times of seeing the signature on the address key." />
      <member type="ENUM(TCP)-Protocol-SERVICE.FTP" name="Protocol" important="True" supported="True" descr="Protocol of interest for this inspector." required="yes" default="TCP" />
      <member type="NUMBER(2-1000)-ResetAfterIdle" name="ResetAfterIdle" important="False" supported="False" descr="Number of seconds to wait to reset signature counters after the host(s) were idle." default="15" />
      <member type="SET(RANGE(1-65535))-ServicePorts" name="ServicePorts" important="True" supported="True" descr="A comma separated list of ports or port ranges where the target service may reside" default="21" />
      <member type="STRING-SigComment" name="SigComment" important="False" supported="True" descr="USER NOTES - miscellaneous information about this signature." />
      <member type="NUMBER(993-50000)-SIGID" name="SIGID" important="True" supported="True" descr="Signature Identifier. 993-19999 valid for default signatures. 20000-50000 valid for user signatures.where parameter" required="yes" key="true" />
      <member type="STRING-SigName" name="SigName" important="True" supported="True" descr="Official name of the signature." />
      <member type="STRING-SigStringInfo" name="SigStringInfo" important="False" supported="True" descr="Extra information included in the alarm message." />
      <member type="STRING-SigVersion" name="SigVersion" important="True" supported="True" descr="Signature update version of signature" />
      <member type="ENUM(AaBb,STREAM)-StorageKey-SERVICE.FTP" name="StorageKey" important="True" supported="True" descr="Type of Address Key used to store persistent data." required="yes" default="STREAM" />
      <member type="NUMBER(0-255)-SubSig" name="SubSig" important="True" supported="True" descr="Sub-Signature ID.  Denotes a specific variant of a signature." default="0" key="true" />
      <member type="ENUM(AaBb)-SummaryKey-SERVICE.FTP" name="SummaryKey" important="False" supported="True" descr="The Storage Type on which to summarize this signature." required="yes" default="AaBb" />
      <member type="NUMBER(0-1000)-ThrottleInterval" name="ThrottleInterval" important="False" supported="True" descr="Number of seconds defining an Alarm Throttle interval.  This is used with the AlarmThrottle parameter to tune special alarm limiters." default="30" />
      <member type="ENUM(True,False)-WantFrag" name="WantFrag" important="True" supported="True" descr="True if a fragment is desired.  False if a fragment is not desired.  Any for either." />
    </tArray>
    <tStruct typeName="SERVICE.FTP" SigMemory="24823">
      <member type="Version" name="version" descr="Engine Version" />
      <member type="SERVICE.FTP-Signatures" name="signatures" descr="FTP service special decode alarms" />
    </tStruct>
    <tString typeName="STRING-ArgNameRegex-SERVICE.HTTP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tString typeName="STRING-ArgValueRegex-SERVICE.HTTP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tEnum typeName="ENUM(True,False)-DeObfuscate-SERVICE.HTTP" min="1" max="1">
      <value name="True" descr="Set value to true." />
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tString typeName="STRING-HeaderRegex-SERVICE.HTTP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tInteger typeName="NUMBER(0-65535)-MaxArgFieldLength-SERVICE.HTTP" min="0" max="65535" type="unsigned" />
    <tInteger typeName="NUMBER(0-65535)-MaxHeaderFieldLength-SERVICE.HTTP" min="0" max="65535" type="unsigned" />
    <tInteger typeName="NUMBER(0-65535)-MaxRequestFieldLength-SERVICE.HTTP" min="0" max="65535" type="unsigned" />
    <tInteger typeName="NUMBER(0-65535)-MaxUriFieldLength-SERVICE.HTTP" min="0" max="65535" type="unsigned" />
    <tInteger typeName="NUMBER(0-65535)-MinRequestMatchLength-SERVICE.HTTP" min="0" max="65535" type="unsigned" />
    <tEnum typeName="ENUM(TCP)-Protocol-SERVICE.HTTP" min="1" max="1">
      <value name="TCP" descr="Interested in L4 TCP protocol" />
    </tEnum>
    <tString typeName="STRING-RequestRegex-SERVICE.HTTP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tEnum typeName="ENUM(AaBb,STREAM)-StorageKey-SERVICE.HTTP" min="1" max="1">
      <value name="AaBb" descr="Interested in Connection QUAD groupings" />
      <value name="STREAM" descr="Interested in reassembled Stream" />
    </tEnum>
    <tEnum typeName="ENUM(AaBb)-SummaryKey-SERVICE.HTTP" min="1" max="1">
      <value name="AaBb" descr="Summarization groupings on the connection QUAD" />
    </tEnum>
    <tInteger typeName="NUMBER(0-65535)-MaxArgFieldLength-SERVICE.HTTP" type="unsigned" min="0" max="65535" />
    <tInteger typeName="NUMBER(0-65535)-MaxHeaderFieldLength-SERVICE.HTTP" type="unsigned" min="0" max="65535" />
    <tInteger typeName="NUMBER(0-65535)-MaxRequestFieldLength-SERVICE.HTTP" type="unsigned" min="0" max="65535" />
    <tInteger typeName="NUMBER(0-65535)-MaxUriFieldLength-SERVICE.HTTP" type="unsigned" min="0" max="65535" />
    <tInteger typeName="NUMBER(0-65535)-MinRequestMatchLength-SERVICE.HTTP" type="unsigned" min="0" max="65535" />
    <tString typeName="STRING-UriRegex-SERVICE.HTTP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tArray typeName="SERVICE.HTTP-Signatures" max="1000">
      <member type="AlarmDelayTimer" name="AlarmDelayTimer" important="False" supported="False" descr="Number of seconds to delay further signature inspection after an alarm." />
      <member type="NUMBER(2-1000)-AlarmInterval" name="AlarmInterval" important="False" supported="True" descr="Special Handling for timed events.  Use AlarmInterval Y with MinHits X for X alarms in Y second interval." />
      <member type="ENUM(high,informational,low,medium)-AlarmSeverity" name="AlarmSeverity" important="True" supported="True" descr="The severity of this alert reported in the alarm." default="medium" />
      <member type="ENUM(FireAll,GlobalSummarize)-AlarmThrottle" name="AlarmThrottle" important="False" supported="True" descr="Technique used to limit alarm firings." default="FireAll" />
      <member type="NUMBER(0-65535)-AlarmTraits" name="AlarmTraits" important="False" supported="True" descr="User-defined traits further describing this signature." />
      <member type="STRING-ArgNameRegex-SERVICE.HTTP" name="ArgNameRegex" important="True" supported="True" descr="Regular Expression to search in the HTTP Arguments Field (after the ? and in the Entity body as defined by Content-Length)." />
      <member type="STRING-ArgValueRegex-SERVICE.HTTP" name="ArgValueRegex" important="True" supported="True" descr="Regular Expression to search in the HTTP Arguments Field after ArgNameRegex is matched. This performs an ordered match and requires ArgNameRegex to be defined." />
      <member type="ENUM(True,False)-CapturePacket" name="CapturePacket" important="False" supported="False" descr="Set to True to include the offending packet in the alarm." default="False" />
      <member type="NUMBER(0-65535)-ChokeThreshold" name="ChokeThreshold" important="False" supported="True" descr="Threshold value of alarms-per-interval to auto-switch AlarmThrottle modes. If ChokeThreshold is defined the sensor will automatically switch AlarmThrottle modes when a large volume of alarms is seen in the ThrottleInterval." default="100" />
      <member type="ENUM(True,False)-DeObfuscate-SERVICE.HTTP" name="DeObfuscate" important="True" supported="True" descr="Apply anti-evasive deobfuscation before searching." default="True" />
      <member type="ENUM(True,False)-Enabled" name="Enabled" important="True" supported="True" descr="True to Enable the Sig. False to Disable the Sig." required="yes" default="True" />
      <member type="ENUM(alarm,drop,reset,denyAttackerInline,denyFlowInline)-EventAction" name="EventAction" important="True" supported="True" descr="What action(s) to perform when the alarm is fired." default="alarm" />
      <member type="ENUM(True,False)-FlipAddr" name="FlipAddr" important="True" supported="True" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)." />
      <member type="STRING-HeaderRegex-SERVICE.HTTP" name="HeaderRegex" important="True" supported="True" descr="Regular Expression to search in the HTTP Header Field. The Header is defined after the first CRLF and continues until CRLFCRLF" />
      <member type="NUMBER(0-65535)-MaxArgFieldLength-SERVICE.HTTP" name="MaxArgFieldLength" important="True" supported="True" descr="Maximum Length of the Arguments Field." />
      <member type="NUMBER(0-65535)-MaxHeaderFieldLength-SERVICE.HTTP" name="MaxHeaderFieldLength" important="True" supported="True" descr="Maximum Length of the Header Field." />
      <member type="NUMBER(0-65535)-MaxInspectLength" name="MaxInspectLength" important="False" supported="False" descr="Maximum number of bytes to inspect." />
      <member type="NUMBER(0-65535)-MaxRequestFieldLength-SERVICE.HTTP" name="MaxRequestFieldLength" important="True" supported="True" descr="Maximum Length of the Request Field." />
      <member type="NUMBER(0-1000)-MaxTTL" name="MaxTTL" important="False" supported="False" descr="Maximum number of seconds to inspect a logical stream. The inspector is deleted after X seconds of being active." />
      <member type="NUMBER(0-65535)-MaxUriFieldLength-SERVICE.HTTP" name="MaxUriFieldLength" important="False" supported="True" descr="Maximum Length of the URI Field." />
      <member type="NUMBER(0-65535)-MinHits" name="MinHits" important="False" supported="True" descr="Minimum number of signature hits before the alarm message is sent.  This a limitter for firing the alarm only after X times of seeing the signature on the address key." />
      <member type="NUMBER(0-65535)-MinRequestMatchLength-SERVICE.HTTP" name="MinRequestMatchLength" important="True" supported="True" descr="Minimum Match Length of the Request Regex." />
      <member type="ENUM(TCP)-Protocol-SERVICE.HTTP" name="Protocol" important="True" supported="True" descr="Protocol of interest for this inspector." required="yes" default="TCP" />
      <member type="STRING-RequestRegex-SERVICE.HTTP" name="RequestRegex" important="True" supported="True" descr="Regular Expression to search in both HTTP URI and HTTP Argument Fields." />
      <member type="NUMBER(2-1000)-ResetAfterIdle" name="ResetAfterIdle" important="False" supported="False" descr="Number of seconds to wait to reset signature counters after the host(s) were idle." default="15" />
      <member type="SET(RANGE(1-65535))-ServicePorts" name="ServicePorts" important="True" supported="True" descr="A comma separated list of ports or port ranges where the target service may reside" required="yes" default="80" />
      <member type="STRING-SigComment" name="SigComment" important="False" supported="True" descr="USER NOTES - miscellaneous information about this signature." />
      <member type="NUMBER(993-50000)-SIGID" name="SIGID" important="True" supported="True" descr="Signature Identifier. 993-19999 valid for default signatures. 20000-50000 valid for user signatures.where parameter" required="yes" key="true" />
      <member type="STRING-SigName" name="SigName" important="True" supported="True" descr="Official name of the signature." />
      <member type="STRING-SigStringInfo" name="SigStringInfo" important="False" supported="True" descr="Extra information included in the alarm message." />
      <member type="STRING-SigVersion" name="SigVersion" important="True" supported="True" descr="Signature update version of signature" />
      <member type="ENUM(AaBb,STREAM)-StorageKey-SERVICE.HTTP" name="StorageKey" important="True" supported="True" descr="Type of Address Key used to store persistent data." required="yes" default="STREAM" />
      <member type="NUMBER(0-255)-SubSig" name="SubSig" important="True" supported="True" descr="Sub-Signature ID.  Denotes a specific variant of a signature." default="0" key="true" />
      <member type="ENUM(AaBb)-SummaryKey-SERVICE.HTTP" name="SummaryKey" important="False" supported="True" descr="The Storage Type on which to summarize this signature." required="yes" default="AaBb" />
      <member type="NUMBER(0-1000)-ThrottleInterval" name="ThrottleInterval" important="False" supported="True" descr="Number of seconds defining an Alarm Throttle interval.  This is used with the AlarmThrottle parameter to tune special alarm limiters." default="30" />
      <member type="STRING-UriRegex-SERVICE.HTTP" name="UriRegex" important="True" supported="True" descr="Regular Expression to search in the HTTP URI Field. The URI field is defined to be after the HTTP method (i.e. GET) and before the first CRLF." />
      <member type="ENUM(True,False)-WantFrag" name="WantFrag" important="True" supported="True" descr="True if a fragment is desired.  False if a fragment is not desired.  Any for either." />
    </tArray>
    <tStruct typeName="SERVICE.HTTP" SigMemory="86213">
      <member type="Version" name="version" descr="Engine Version" />
      <member type="SERVICE.HTTP-Signatures" name="signatures" descr="HTTP protocol decode based string search Engine. Includes anti-evasive URL deobfuscation" />
    </tStruct>
    <tEnum typeName="ENUM(ToService,FromService)-Direction-SERVICE.RPC" min="1" max="1">
      <value name="ToService" descr="Want only the server-bound side of the conversation" />
      <value name="FromService" descr="Want only the client-bound side of the conversation" />
    </tEnum>
    <tEnum typeName="ENUM(True,False)-isPortMapper-SERVICE.RPC" min="1" max="1">
      <value name="True" descr="Set value to true." />
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tEnum typeName="ENUM(True,False)-isSpoofSrc-SERVICE.RPC" min="1" max="1">
      <value name="True" descr="Set value to true." />
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tEnum typeName="ENUM(False)-isSweep-SERVICE.RPC" min="1" max="1">
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tInteger typeName="NUMBER(0-4294967295)-PortMapProgram-SERVICE.RPC" min="0" max="4294967295" type="unsigned" />
    <tEnum typeName="ENUM(TCP,UDP)-Protocol-SERVICE.RPC" min="1" max="1">
      <value name="TCP" descr="Interested in L4 TCP protocol" />
      <value name="UDP" descr="Interested in L4 UDP protocol" />
    </tEnum>
    <tInteger typeName="NUMBER(0-999999)-RpcMaxLength-SERVICE.RPC" min="0" max="999999" type="unsigned" />
    <tInteger typeName="NUMBER(0-65535)-RpcProcedure-SERVICE.RPC" min="0" max="65535" type="unsigned" />
    <tInteger typeName="NUMBER(0-999999)-RpcProgram-SERVICE.RPC" min="0" max="999999" type="unsigned" />
    <tEnum typeName="ENUM(xxxx,AaBb,STREAM)-StorageKey-SERVICE.RPC" min="1" max="1">
      <value name="xxxx" descr="Interested in GLOBAL (all addresses wildcarded) storage" />
      <value name="AaBb" descr="Interested in Connection QUAD groupings" />
      <value name="STREAM" descr="Interested in reassembled Stream" />
    </tEnum>
    <tEnum typeName="ENUM(AaBb)-SummaryKey-SERVICE.RPC" min="1" max="1">
      <value name="AaBb" descr="Summarization groupings on the connection QUAD" />
    </tEnum>
    <tInteger typeName="NUMBER(2-40)-Unique-SERVICE.RPC" min="2" max="40" type="unsigned" />
    <tArray typeName="SERVICE.RPC-Signatures" max="1000">
      <member type="AlarmDelayTimer" name="AlarmDelayTimer" important="False" supported="False" descr="Number of seconds to delay further signature inspection after an alarm." />
      <member type="NUMBER(2-1000)-AlarmInterval" name="AlarmInterval" important="False" supported="True" descr="Special Handling for timed events.  Use AlarmInterval Y with MinHits X for X alarms in Y second interval." />
      <member type="ENUM(high,informational,low,medium)-AlarmSeverity" name="AlarmSeverity" important="True" supported="True" descr="The severity of this alert reported in the alarm." default="medium" />
      <member type="ENUM(FireAll,GlobalSummarize)-AlarmThrottle" name="AlarmThrottle" important="False" supported="True" descr="Technique used to limit alarm firings." default="FireAll" />
      <member type="NUMBER(0-65535)-AlarmTraits" name="AlarmTraits" important="False" supported="True" descr="User-defined traits further describing this signature." />
      <member type="ENUM(True,False)-CapturePacket" name="CapturePacket" important="False" supported="False" descr="Set to True to include the offending packet in the alarm." default="False" />
      <member type="NUMBER(0-65535)-ChokeThreshold" name="ChokeThreshold" important="False" supported="True" descr="Threshold value of alarms-per-interval to auto-switch AlarmThrottle modes. If ChokeThreshold is defined the sensor will automatically switch AlarmThrottle modes when a large volume of alarms is seen in the ThrottleInterval." default="100" />
      <member type="ENUM(ToService,FromService)-Direction-SERVICE.RPC" name="Direction" important="True" supported="True" descr="One of `ToService` or `FromService` indicating whether we are watching traffic destined to or coming from the service port" default="ToService" />
      <member type="ENUM(True,False)-Enabled" name="Enabled" important="True" supported="True" descr="True to Enable the Sig. False to Disable the Sig." required="yes" default="True" />
      <member type="ENUM(alarm,drop,reset,denyAttackerInline,denyFlowInline)-EventAction" name="EventAction" important="True" supported="True" descr="What action(s) to perform when the alarm is fired." default="alarm" />
      <member type="ENUM(True,False)-FlipAddr" name="FlipAddr" important="True" supported="True" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)." />
      <member type="ENUM(True,False)-isPortMapper-SERVICE.RPC" name="isPortMapper" important="True" supported="True" descr="Is this signature interested in port 111 traffic?" />
      <member type="ENUM(True,False)-isSpoofSrc-SERVICE.RPC" name="isSpoofSrc" important="True" supported="True" descr="Fire alarm when the SrcAddress is 127.0.0.1" default="False" />
      <member type="ENUM(False)-isSweep-SERVICE.RPC" name="isSweep" important="True" supported="True" descr="Is this signature a RPC sweep.  Must set value for Unique for this to be valid." required="yes" />
      <member type="NUMBER(0-65535)-MaxInspectLength" name="MaxInspectLength" important="False" supported="False" descr="Maximum number of bytes to inspect." />
      <member type="NUMBER(0-1000)-MaxTTL" name="MaxTTL" important="False" supported="False" descr="Maximum number of seconds to inspect a logical stream. The inspector is deleted after X seconds of being active." />
      <member type="NUMBER(0-65535)-MinHits" name="MinHits" important="False" supported="True" descr="Minimum number of signature hits before the alarm message is sent.  This a limitter for firing the alarm only after X times of seeing the signature on the address key." />
      <member type="NUMBER(0-4294967295)-PortMapProgram-SERVICE.RPC" name="PortMapProgram" important="True" supported="True" descr="Program number sent to PortMapper of interest for this sig." />
      <member type="ENUM(TCP,UDP)-Protocol-SERVICE.RPC" name="Protocol" important="True" supported="True" descr="Protocol of interest for this inspector." required="yes" default="UDP" />
      <member type="NUMBER(2-1000)-ResetAfterIdle" name="ResetAfterIdle" important="False" supported="False" descr="Number of seconds to wait to reset signature counters after the host(s) were idle." default="15" />
      <member type="NUMBER(0-999999)-RpcMaxLength-SERVICE.RPC" name="RpcMaxLength" important="True" supported="True" descr="Maximum allowed length of whole RPC message.  Lengths longer than this will cause alarm." />
      <member type="NUMBER(0-65535)-RpcProcedure-SERVICE.RPC" name="RpcProcedure" important="True" supported="True" descr="RPC Procedure number of interest for this sig." />
      <member type="NUMBER(0-999999)-RpcProgram-SERVICE.RPC" name="RpcProgram" important="True" supported="True" descr="Rpc Program Number of interest for this sig." />
      <member type="SET(RANGE(1-65535))-ServicePorts" name="ServicePorts" important="True" supported="True" descr="A comma separated list of ports or port ranges where the target service may reside" default="111,550-65535" />
      <member type="STRING-SigComment" name="SigComment" important="False" supported="True" descr="USER NOTES - miscellaneous information about this signature." />
      <member type="NUMBER(993-50000)-SIGID" name="SIGID" important="True" supported="True" descr="Signature Identifier. 993-19999 valid for default signatures. 20000-50000 valid for user signatures.where parameter" required="yes" key="true" />
      <member type="STRING-SigName" name="SigName" important="True" supported="True" descr="Official name of the signature." />
      <member type="STRING-SigStringInfo" name="SigStringInfo" important="False" supported="True" descr="Extra information included in the alarm message." />
      <member type="STRING-SigVersion" name="SigVersion" important="True" supported="True" descr="Signature update version of signature" />
      <member type="ENUM(xxxx,AaBb,STREAM)-StorageKey-SERVICE.RPC" name="StorageKey" important="True" supported="True" descr="Type of Address Key used to store persistent data." required="yes" default="AaBb" />
      <member type="NUMBER(0-255)-SubSig" name="SubSig" important="True" supported="True" descr="Sub-Signature ID.  Denotes a specific variant of a signature." default="0" key="true" />
      <member type="ENUM(AaBb)-SummaryKey-SERVICE.RPC" name="SummaryKey" important="False" supported="True" descr="The Storage Type on which to summarize this signature." required="yes" default="AaBb" />
      <member type="NUMBER(0-1000)-ThrottleInterval" name="ThrottleInterval" important="False" supported="True" descr="Number of seconds defining an Alarm Throttle interval.  This is used with the AlarmThrottle parameter to tune special alarm limiters." default="30" />
      <member type="NUMBER(2-40)-Unique-SERVICE.RPC" name="Unique" important="True" supported="False" descr="For sweeps, Threshold number of unique port connections allowed until the alarm fires. Must have parameter isSweep True for this to be valid." />
      <member type="ENUM(True,False)-WantFrag" name="WantFrag" important="True" supported="True" descr="True if a fragment is desired.  False if a fragment is not desired.  Any for either." />
    </tArray>
    <tStruct typeName="SERVICE.RPC" SigMemory="6581">
      <member type="Version" name="version" descr="Engine Version" />
      <member type="SERVICE.RPC-Signatures" name="signatures" descr="RPC SERVICE analysis engine" />
    </tStruct>
    <tEnum typeName="ENUM(ToService,FromService)-Direction-SERVICE.SMTP" min="1" max="1">
      <value name="ToService" descr="Want only the server-bound side of the conversation" />
      <value name="FromService" descr="Want only the client-bound side of the conversation" />
    </tEnum>
    <tInteger typeName="NUMBER(0-65535)-EndMatchOffset-SERVICE.SMTP" min="0" max="65535" type="unsigned" />
    <tInteger typeName="NUMBER(0-65535)-MinMatchLength-SERVICE.SMTP" min="0" max="65535" type="unsigned" />
    <tEnum typeName="ENUM(TCP)-Protocol-SERVICE.SMTP" min="1" max="1">
      <value name="TCP" descr="Interested in L4 TCP protocol" />
    </tEnum>
    <tString typeName="STRING-RegexString-SERVICE.SMTP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tEnum typeName="ENUM(ABORT,MailBody,MailHeader,SmtpCommands,START)-StateName-SERVICE.SMTP" min="1" max="1">
      <value name="ABORT" descr="Start or reset state of conversation" />
      <value name="MailBody" descr="Mail Body has been seen" />
      <value name="MailHeader" descr="Mail Header has been seen" />
      <value name="SmtpCommands" descr="SMTP Commands have been seen" />
      <value name="START" descr="Data conversation has started" />
    </tEnum>
    <tEnum typeName="ENUM(AaBb,STREAM)-StorageKey-SERVICE.SMTP" min="1" max="1">
      <value name="AaBb" descr="Interested in Connection QUAD groupings" />
      <value name="STREAM" descr="Interested in reassembled Stream" />
    </tEnum>
    <tEnum typeName="ENUM(AaBb)-SummaryKey-SERVICE.SMTP" min="1" max="1">
      <value name="AaBb" descr="Summarization groupings on the connection QUAD" />
    </tEnum>
    <tArray typeName="SERVICE.SMTP-Signatures" max="1000">
      <member type="AlarmDelayTimer" name="AlarmDelayTimer" important="False" supported="False" descr="Number of seconds to delay further signature inspection after an alarm." />
      <member type="NUMBER(2-1000)-AlarmInterval" name="AlarmInterval" important="False" supported="True" descr="Special Handling for timed events.  Use AlarmInterval Y with MinHits X for X alarms in Y second interval." />
      <member type="ENUM(high,informational,low,medium)-AlarmSeverity" name="AlarmSeverity" important="True" supported="True" descr="The severity of this alert reported in the alarm." default="medium" />
      <member type="ENUM(FireAll,GlobalSummarize)-AlarmThrottle" name="AlarmThrottle" important="False" supported="True" descr="Technique used to limit alarm firings." default="FireAll" />
      <member type="NUMBER(0-65535)-AlarmTraits" name="AlarmTraits" important="False" supported="True" descr="User-defined traits further describing this signature." />
      <member type="ENUM(True,False)-CapturePacket" name="CapturePacket" important="False" supported="False" descr="Set to True to include the offending packet in the alarm." default="False" />
      <member type="NUMBER(0-65535)-ChokeThreshold" name="ChokeThreshold" important="False" supported="True" descr="Threshold value of alarms-per-interval to auto-switch AlarmThrottle modes. If ChokeThreshold is defined the sensor will automatically switch AlarmThrottle modes when a large volume of alarms is seen in the ThrottleInterval." default="100" />
      <member type="ENUM(ToService,FromService)-Direction-SERVICE.SMTP" name="Direction" important="True" supported="True" descr="One of `ToService` or `FromService` indicating whether we are watching traffic destined to or coming from the service port" default="ToService" />
      <member type="ENUM(True,False)-Enabled" name="Enabled" important="True" supported="True" descr="True to Enable the Sig. False to Disable the Sig." required="yes" default="True" />
      <member type="NUMBER(0-65535)-EndMatchOffset-SERVICE.SMTP" name="EndMatchOffset" important="True" supported="True" descr="The exact stream offset the RegexString must report a match to be valid." />
      <member type="ENUM(alarm,drop,reset,denyAttackerInline,denyFlowInline)-EventAction" name="EventAction" important="True" supported="True" descr="What action(s) to perform when the alarm is fired." default="alarm" />
      <member type="ENUM(True,False)-FlipAddr" name="FlipAddr" important="True" supported="True" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)." />
      <member type="NUMBER(0-65535)-MaxInspectLength" name="MaxInspectLength" important="False" supported="False" descr="Maximum number of bytes to inspect." />
      <member type="NUMBER(0-1000)-MaxTTL" name="MaxTTL" important="False" supported="False" descr="Maximum number of seconds to inspect a logical stream. The inspector is deleted after X seconds of being active." />
      <member type="NUMBER(0-65535)-MinHits" name="MinHits" important="False" supported="True" descr="Minimum number of signature hits before the alarm message is sent.  This a limitter for firing the alarm only after X times of seeing the signature on the address key." />
      <member type="NUMBER(0-65535)-MinMatchLength-SERVICE.SMTP" name="MinMatchLength" important="True" supported="True" descr="Minimum number of bytes the RegexString must match." />
      <member type="ENUM(TCP)-Protocol-SERVICE.SMTP" name="Protocol" important="True" supported="True" descr="Protocol of interest for this inspector." required="yes" default="TCP" />
      <member type="STRING-RegexString-SERVICE.SMTP" name="RegexString" important="True" supported="True" descr="Regular Expression of string to match." required="yes" />
      <member type="NUMBER(2-1000)-ResetAfterIdle" name="ResetAfterIdle" important="False" supported="False" descr="Number of seconds to wait to reset signature counters after the host(s) were idle." default="15" />
      <member type="SET(RANGE(1-65535))-ServicePorts" name="ServicePorts" important="True" supported="True" descr="A comma separated list of ports or port ranges where the target service may reside" required="yes" default="25" />
      <member type="STRING-SigComment" name="SigComment" important="False" supported="True" descr="USER NOTES - miscellaneous information about this signature." />
      <member type="NUMBER(993-50000)-SIGID" name="SIGID" important="True" supported="True" descr="Signature Identifier. 993-19999 valid for default signatures. 20000-50000 valid for user signatures.where parameter" required="yes" key="true" />
      <member type="STRING-SigName" name="SigName" important="True" supported="True" descr="Official name of the signature." />
      <member type="STRING-SigStringInfo" name="SigStringInfo" important="False" supported="True" descr="Extra information included in the alarm message." />
      <member type="STRING-SigVersion" name="SigVersion" important="True" supported="True" descr="Signature update version of signature" />
      <member type="ENUM(ABORT,MailBody,MailHeader,SmtpCommands,START)-StateName-SERVICE.SMTP" name="StateName" important="True" supported="True" descr="Name of a State in the Engine`s StateMachine in which to restrict the RegexString match." required="yes" />
      <member type="ENUM(AaBb,STREAM)-StorageKey-SERVICE.SMTP" name="StorageKey" important="True" supported="True" descr="Type of Address Key used to store persistent data." required="yes" default="STREAM" />
      <member type="NUMBER(0-255)-SubSig" name="SubSig" important="True" supported="True" descr="Sub-Signature ID.  Denotes a specific variant of a signature." default="0" key="true" />
      <member type="ENUM(AaBb)-SummaryKey-SERVICE.SMTP" name="SummaryKey" important="False" supported="True" descr="The Storage Type on which to summarize this signature." required="yes" default="AaBb" />
      <member type="NUMBER(0-1000)-ThrottleInterval" name="ThrottleInterval" important="False" supported="True" descr="Number of seconds defining an Alarm Throttle interval.  This is used with the AlarmThrottle parameter to tune special alarm limiters." default="30" />
      <member type="ENUM(True,False)-WantFrag" name="WantFrag" important="True" supported="True" descr="True if a fragment is desired.  False if a fragment is not desired.  Any for either." />
    </tArray>
    <tStruct typeName="SERVICE.SMTP" SigMemory="1733827">
      <member type="Version" name="version" descr="Engine Version" />
      <member type="SERVICE.SMTP-Signatures" name="signatures" descr="SMTP Protocol Inspection Engine" />
    </tStruct>
    <tEnum typeName="ENUM(ToService,FromService)-Direction-STRING.TCP" min="1" max="1">
      <value name="ToService" descr="Want only the server-bound side of the conversation" />
      <value name="FromService" descr="Want only the client-bound side of the conversation" />
    </tEnum>
    <tInteger typeName="NUMBER(0-65535)-EndMatchOffset-STRING.TCP" min="0" max="65535" type="unsigned" />
    <tInteger typeName="NUMBER(0-65535)-MinMatchLength-STRING.TCP" min="0" max="65535" type="unsigned" />
    <tEnum typeName="ENUM(TCP)-Protocol-STRING.TCP" min="1" max="1">
      <value name="TCP" descr="Interested in L4 TCP protocol" />
    </tEnum>
    <tString typeName="STRING-RegexString-STRING.TCP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tEnum typeName="ENUM(AaBb,STREAM)-StorageKey-STRING.TCP" min="1" max="1">
      <value name="AaBb" descr="Interested in Connection QUAD groupings" />
      <value name="STREAM" descr="Interested in reassembled Stream" />
    </tEnum>
    <tEnum typeName="ENUM(xxxx)-SummaryKey-STRING.TCP" min="1" max="1">
      <value name="xxxx" descr="Summarization groupings on all addresses" />
    </tEnum>
    <tEnum typeName="ENUM(True,False)-StripTelnetOptions-STRING.TCP" min="1" max="1">
      <value name="True" descr="Set value to true." />
      <value name="False" descr="Set value to false." />
    </tEnum>
    <tArray typeName="STRING.TCP-Signatures" max="1000">
      <member type="AlarmDelayTimer" name="AlarmDelayTimer" important="False" supported="False" descr="Number of seconds to delay further signature inspection after an alarm." />
      <member type="NUMBER(2-1000)-AlarmInterval" name="AlarmInterval" important="False" supported="True" descr="Special Handling for timed events.  Use AlarmInterval Y with MinHits X for X alarms in Y second interval." />
      <member type="ENUM(high,informational,low,medium)-AlarmSeverity" name="AlarmSeverity" important="True" supported="True" descr="The severity of this alert reported in the alarm." default="medium" />
      <member type="ENUM(FireAll,GlobalSummarize)-AlarmThrottle" name="AlarmThrottle" important="False" supported="True" descr="Technique used to limit alarm firings." default="FireAll" />
      <member type="NUMBER(0-65535)-AlarmTraits" name="AlarmTraits" important="False" supported="True" descr="User-defined traits further describing this signature." />
      <member type="ENUM(True,False)-CapturePacket" name="CapturePacket" important="False" supported="False" descr="Set to True to include the offending packet in the alarm." default="False" />
      <member type="NUMBER(0-65535)-ChokeThreshold" name="ChokeThreshold" important="False" supported="True" descr="Threshold value of alarms-per-interval to auto-switch AlarmThrottle modes. If ChokeThreshold is defined the sensor will automatically switch AlarmThrottle modes when a large volume of alarms is seen in the ThrottleInterval." default="100" />
      <member type="ENUM(ToService,FromService)-Direction-STRING.TCP" name="Direction" important="True" supported="True" descr="One of `ToService` or `FromService` indicating whether we are watching traffic destined to or coming from the service port" required="yes" default="ToService" />
      <member type="ENUM(True,False)-Enabled" name="Enabled" important="True" supported="True" descr="True to Enable the Sig. False to Disable the Sig." required="yes" default="True" />
      <member type="NUMBER(0-65535)-EndMatchOffset-STRING.TCP" name="EndMatchOffset" important="True" supported="True" descr="The exact stream offset the RegexString must report a match to be valid." />
      <member type="ENUM(alarm,drop,reset,denyAttackerInline,denyFlowInline)-EventAction" name="EventAction" important="True" supported="True" descr="What action(s) to perform when the alarm is fired." default="alarm" />
      <member type="ENUM(True,False)-FlipAddr" name="FlipAddr" important="True" supported="True" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)." />
      <member type="NUMBER(0-65535)-MaxInspectLength" name="MaxInspectLength" important="False" supported="False" descr="Maximum number of bytes to inspect." />
      <member type="NUMBER(0-1000)-MaxTTL" name="MaxTTL" important="False" supported="False" descr="Maximum number of seconds to inspect a logical stream. The inspector is deleted after X seconds of being active." />
      <member type="NUMBER(0-65535)-MinHits" name="MinHits" important="False" supported="True" descr="Minimum number of signature hits before the alarm message is sent.  This a limitter for firing the alarm only after X times of seeing the signature on the address key." />
      <member type="NUMBER(0-65535)-MinMatchLength-STRING.TCP" name="MinMatchLength" important="True" supported="True" descr="Minimum number of bytes the RegexString must match." />
      <member type="ENUM(TCP)-Protocol-STRING.TCP" name="Protocol" important="True" supported="True" descr="Protocol of interest for this inspector." required="yes" default="TCP" />
      <member type="STRING-RegexString-STRING.TCP" name="RegexString" important="True" supported="True" descr="Ordered list of Regular Expressions to search." required="yes" />
      <member type="NUMBER(2-1000)-ResetAfterIdle" name="ResetAfterIdle" important="False" supported="False" descr="Number of seconds to wait to reset signature counters after the host(s) were idle." default="15" />
      <member type="SET(RANGE(1-65535))-ServicePorts" name="ServicePorts" important="True" supported="True" descr="A comma separated list of ports or port ranges where the target service may reside" required="yes" />
      <member type="STRING-SigComment" name="SigComment" important="False" supported="True" descr="USER NOTES - miscellaneous information about this signature." />
      <member type="NUMBER(993-50000)-SIGID" name="SIGID" important="True" supported="True" descr="Signature Identifier. 993-19999 valid for default signatures. 20000-50000 valid for user signatures.where parameter" required="yes" key="true" />
      <member type="STRING-SigName" name="SigName" important="True" supported="True" descr="Official name of the signature." />
      <member type="STRING-SigStringInfo" name="SigStringInfo" important="False" supported="True" descr="Extra information included in the alarm message." />
      <member type="STRING-SigVersion" name="SigVersion" important="True" supported="True" descr="Signature update version of signature" />
      <member type="ENUM(AaBb,STREAM)-StorageKey-STRING.TCP" name="StorageKey" important="True" supported="True" descr="Type of Address Key used to store persistent data." required="yes" default="AaBb" />
      <member type="ENUM(True,False)-StripTelnetOptions-STRING.TCP" name="StripTelnetOptions" important="True" supported="True" descr="Strip telnet option characters from data before searching." />
      <member type="NUMBER(0-255)-SubSig" name="SubSig" important="True" supported="True" descr="Sub-Signature ID.  Denotes a specific variant of a signature." default="0" key="true" />
      <member type="ENUM(xxxx)-SummaryKey-STRING.TCP" name="SummaryKey" important="False" supported="True" descr="The Storage Type on which to summarize this signature." required="yes" default="xxxx" />
      <member type="NUMBER(0-1000)-ThrottleInterval" name="ThrottleInterval" important="False" supported="True" descr="Number of seconds defining an Alarm Throttle interval.  This is used with the AlarmThrottle parameter to tune special alarm limiters." default="30" />
      <member type="ENUM(True,False)-WantFrag" name="WantFrag" important="True" supported="True" descr="True if a fragment is desired.  False if a fragment is not desired.  Any for either." />
    </tArray>
    <tStruct typeName="STRING.TCP" SigMemory="4291">
      <member type="Version" name="version" descr="Engine Version" />
      <member type="STRING.TCP-Signatures" name="signatures" descr="Generic TCP based string search Engine." />
    </tStruct>
    <tEnum typeName="ENUM(ToService,FromService)-Direction-STRING.UDP" min="1" max="1">
      <value name="ToService" descr="Want only the server-bound side of the conversation" />
      <value name="FromService" descr="Want only the client-bound side of the conversation" />
    </tEnum>
    <tInteger typeName="NUMBER(0-65535)-EndMatchOffset-STRING.UDP" min="0" max="65535" type="unsigned" />
    <tInteger typeName="NUMBER(0-65535)-MinMatchLength-STRING.UDP" min="0" max="65535" type="unsigned" />
    <tEnum typeName="ENUM(UDP)-Protocol-STRING.UDP" min="1" max="1">
      <value name="UDP" descr="Interested in L4 UDP protocol" />
    </tEnum>
    <tString typeName="STRING-RegexString-STRING.UDP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tEnum typeName="ENUM(xxxx,AaBb)-StorageKey-STRING.UDP" min="1" max="1">
      <value name="xxxx" descr="Interested in GLOBAL (all addresses wildcarded) storage" />
      <value name="AaBb" descr="Interested in Connection QUAD groupings" />
    </tEnum>
    <tEnum typeName="ENUM(xxxx)-SummaryKey-STRING.UDP" min="1" max="1">
      <value name="xxxx" descr="Summarization groupings on all addresses" />
    </tEnum>
    <tArray typeName="STRING.UDP-Signatures" max="1000">
      <member type="AlarmDelayTimer" name="AlarmDelayTimer" important="False" supported="False" descr="Number of seconds to delay further signature inspection after an alarm." />
      <member type="NUMBER(2-1000)-AlarmInterval" name="AlarmInterval" important="False" supported="True" descr="Special Handling for timed events.  Use AlarmInterval Y with MinHits X for X alarms in Y second interval." />
      <member type="ENUM(high,informational,low,medium)-AlarmSeverity" name="AlarmSeverity" important="True" supported="True" descr="The severity of this alert reported in the alarm." default="medium" />
      <member type="ENUM(FireAll,GlobalSummarize)-AlarmThrottle" name="AlarmThrottle" important="False" supported="True" descr="Technique used to limit alarm firings." default="FireAll" />
      <member type="NUMBER(0-65535)-AlarmTraits" name="AlarmTraits" important="False" supported="True" descr="User-defined traits further describing this signature." />
      <member type="ENUM(True,False)-CapturePacket" name="CapturePacket" important="False" supported="False" descr="Set to True to include the offending packet in the alarm." default="False" />
      <member type="NUMBER(0-65535)-ChokeThreshold" name="ChokeThreshold" important="False" supported="True" descr="Threshold value of alarms-per-interval to auto-switch AlarmThrottle modes. If ChokeThreshold is defined the sensor will automatically switch AlarmThrottle modes when a large volume of alarms is seen in the ThrottleInterval." default="100" />
      <member type="ENUM(ToService,FromService)-Direction-STRING.UDP" name="Direction" important="True" supported="True" descr="One of `ToService` or `FromService` indicating whether we are watching traffic destined to or coming from the service port" required="yes" default="ToService" />
      <member type="ENUM(True,False)-Enabled" name="Enabled" important="True" supported="True" descr="True to Enable the Sig. False to Disable the Sig." required="yes" default="True" />
      <member type="NUMBER(0-65535)-EndMatchOffset-STRING.UDP" name="EndMatchOffset" important="True" supported="True" descr="The exact stream offset the RegexString must report a match to be valid." />
      <member type="ENUM(alarm,drop,reset,denyAttackerInline,denyFlowInline)-EventAction" name="EventAction" important="True" supported="True" descr="What action(s) to perform when the alarm is fired." default="alarm" />
      <member type="ENUM(True,False)-FlipAddr" name="FlipAddr" important="True" supported="True" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)." />
      <member type="NUMBER(0-65535)-MaxInspectLength" name="MaxInspectLength" important="False" supported="False" descr="Maximum number of bytes to inspect." />
      <member type="NUMBER(0-1000)-MaxTTL" name="MaxTTL" important="False" supported="False" descr="Maximum number of seconds to inspect a logical stream. The inspector is deleted after X seconds of being active." />
      <member type="NUMBER(0-65535)-MinHits" name="MinHits" important="False" supported="True" descr="Minimum number of signature hits before the alarm message is sent.  This a limitter for firing the alarm only after X times of seeing the signature on the address key." />
      <member type="NUMBER(0-65535)-MinMatchLength-STRING.UDP" name="MinMatchLength" important="True" supported="True" descr="Minimum number of bytes the RegexString must match." />
      <member type="ENUM(UDP)-Protocol-STRING.UDP" name="Protocol" important="True" supported="True" descr="Protocol of interest for this inspector." required="yes" default="UDP" />
      <member type="STRING-RegexString-STRING.UDP" name="RegexString" important="True" supported="True" descr="Ordered list of Regular Expressions to search." required="yes" />
      <member type="NUMBER(2-1000)-ResetAfterIdle" name="ResetAfterIdle" important="False" supported="False" descr="Number of seconds to wait to reset signature counters after the host(s) were idle." default="15" />
      <member type="SET(RANGE(1-65535))-ServicePorts" name="ServicePorts" important="True" supported="True" descr="A comma separated list of ports or port ranges where the target service may reside" required="yes" />
      <member type="STRING-SigComment" name="SigComment" important="False" supported="True" descr="USER NOTES - miscellaneous information about this signature." />
      <member type="NUMBER(993-50000)-SIGID" name="SIGID" important="True" supported="True" descr="Signature Identifier. 993-19999 valid for default signatures. 20000-50000 valid for user signatures.where parameter" required="yes" key="true" />
      <member type="STRING-SigName" name="SigName" important="True" supported="True" descr="Official name of the signature." />
      <member type="STRING-SigStringInfo" name="SigStringInfo" important="False" supported="True" descr="Extra information included in the alarm message." />
      <member type="STRING-SigVersion" name="SigVersion" important="True" supported="True" descr="Signature update version of signature" />
      <member type="ENUM(xxxx,AaBb)-StorageKey-STRING.UDP" name="StorageKey" important="True" supported="True" descr="Type of Address Key used to store persistent data." required="yes" default="AaBb" />
      <member type="NUMBER(0-255)-SubSig" name="SubSig" important="True" supported="True" descr="Sub-Signature ID.  Denotes a specific variant of a signature." default="0" key="true" />
      <member type="ENUM(xxxx)-SummaryKey-STRING.UDP" name="SummaryKey" important="False" supported="True" descr="The Storage Type on which to summarize this signature." required="yes" default="xxxx" />
      <member type="NUMBER(0-1000)-ThrottleInterval" name="ThrottleInterval" important="False" supported="True" descr="Number of seconds defining an Alarm Throttle interval.  This is used with the AlarmThrottle parameter to tune special alarm limiters." default="30" />
      <member type="ENUM(True,False)-WantFrag" name="WantFrag" important="True" supported="True" descr="True if a fragment is desired.  False if a fragment is not desired.  Any for either." />
    </tArray>
    <tStruct typeName="STRING.UDP" SigMemory="4291">
      <member type="Version" name="version" descr="Engine Version" />
      <member type="STRING.UDP-Signatures" name="signatures" descr="Generic UDP based string search Engine" />
    </tStruct>
    <tEnum typeName="ENUM(ToService,FromService)-Direction-STRING.ICMP" min="1" max="1">
      <value name="ToService" descr="Want only the server-bound side of the conversation" />
      <value name="FromService" descr="Want only the client-bound side of the conversation" />
    </tEnum>
    <tInteger typeName="NUMBER(0-65535)-EndMatchOffset-STRING.ICMP" min="0" max="65535" type="unsigned" />
    <tInteger typeName="NUMBER(0-65535)-MinMatchLength-STRING.ICMP" min="0" max="65535" type="unsigned" />
    <tEnum typeName="ENUM(UDP)-Protocol-STRING.ICMP" min="1" max="1">
      <value name="UDP" descr="Interested in L4 UDP protocol" />
    </tEnum>
    <tString typeName="STRING-RegexString-STRING.ICMP" pattern="^[\n\r\t\x20-\xFF]*$" allowAnything="true" />
    <tEnum typeName="ENUM(AxBx)-StorageKey-STRING.ICMP" min="1" max="1">
      <value name="AxBx" descr="Interested in source and dest address pair groupings direction sensitive" />
    </tEnum>
    <tIntegerRange typeName="SET(RANGE(0-65535))-ServicePorts-STRING.ICMP" allowMultiple="true" type="unsigned" min="0" max="65535" />
    <tEnum typeName="ENUM(xxxx)-SummaryKey-STRING.ICMP" min="1" max="1">
      <value name="xxxx" descr="Summarization groupings on all addresses" />
    </tEnum>
    <tArray typeName="STRING.ICMP-Signatures" max="1000">
      <member type="AlarmDelayTimer" name="AlarmDelayTimer" important="False" supported="False" descr="Number of seconds to delay further signature inspection after an alarm." />
      <member type="NUMBER(2-1000)-AlarmInterval" name="AlarmInterval" important="False" supported="True" descr="Special Handling for timed events.  Use AlarmInterval Y with MinHits X for X alarms in Y second interval." />
      <member type="ENUM(high,informational,low,medium)-AlarmSeverity" name="AlarmSeverity" important="True" supported="True" descr="The severity of this alert reported in the alarm." default="medium" />
      <member type="ENUM(FireAll,GlobalSummarize)-AlarmThrottle" name="AlarmThrottle" important="False" supported="True" descr="Technique used to limit alarm firings." default="FireAll" />
      <member type="NUMBER(0-65535)-AlarmTraits" name="AlarmTraits" important="False" supported="True" descr="User-defined traits further describing this signature." />
      <member type="ENUM(True,False)-CapturePacket" name="CapturePacket" important="False" supported="False" descr="Set to True to include the offending packet in the alarm." default="False" />
      <member type="NUMBER(0-65535)-ChokeThreshold" name="ChokeThreshold" important="False" supported="True" descr="Threshold value of alarms-per-interval to auto-switch AlarmThrottle modes. If ChokeThreshold is defined the sensor will automatically switch AlarmThrottle modes when a large volume of alarms is seen in the ThrottleInterval." default="100" />
      <member type="ENUM(ToService,FromService)-Direction-STRING.ICMP" name="Direction" important="True" supported="True" descr="One of `ToService` or `FromService` indicating whether we are watching traffic destined to or coming from the service port" required="yes" default="ToService" />
      <member type="ENUM(True,False)-Enabled" name="Enabled" important="True" supported="True" descr="True to Enable the Sig. False to Disable the Sig." required="yes" default="True" />
      <member type="NUMBER(0-65535)-EndMatchOffset-STRING.ICMP" name="EndMatchOffset" important="True" supported="True" descr="The exact stream offset the RegexString must report a match to be valid." />
      <member type="ENUM(alarm,drop,reset,denyAttackerInline,denyFlowInline)-EventAction" name="EventAction" important="True" supported="True" descr="What action(s) to perform when the alarm is fired." default="alarm" />
      <member type="ENUM(True,False)-FlipAddr" name="FlipAddr" important="True" supported="True" descr="True if address (and ports) Source and Destination are swapped in the alarm message.  False for no swap (normal)." />
      <member type="NUMBER(0-65535)-MaxInspectLength" name="MaxInspectLength" important="False" supported="False" descr="Maximum number of bytes to inspect." />
      <member type="NUMBER(0-1000)-MaxTTL" name="MaxTTL" important="False" supported="False" descr="Maximum number of seconds to inspect a logical stream. The inspector is deleted after X seconds of being active." />
      <member type="NUMBER(0-65535)-MinHits" name="MinHits" important="False" supported="True" descr="Minimum number of signature hits before the alarm message is sent.  This a limitter for firing the alarm only after X times of seeing the signature on the address key." />
      <member type="NUMBER(0-65535)-MinMatchLength-STRING.ICMP" name="MinMatchLength" important="True" supported="True" descr="Minimum number of bytes the RegexString must match." />
      <member type="ENUM(UDP)-Protocol-STRING.ICMP" name="Protocol" important="True" supported="True" descr="Protocol of interest for this inspector." required="yes" default="UDP" />
      <member type="STRING-RegexString-STRING.ICMP" name="RegexString" important="True" supported="True" descr="Ordered list of Regular Expressions to search." required="yes" />
      <member type="NUMBER(2-1000)-ResetAfterIdle" name="ResetAfterIdle" important="False" supported="False" descr="Number of seconds to wait to reset signature counters after the host(s) were idle." default="15" />
      <member type="SET(RANGE(0-65535))-ServicePorts-STRING.ICMP" name="ServicePorts" important="True" supported="True" descr="A comma separated list of ports or port ranges where the target service may reside" required="yes" default="0-20" />
      <member type="STRING-SigComment" name="SigComment" important="False" supported="True" descr="USER NOTES - miscellaneous information about this signature." />
      <member type="NUMBER(993-50000)-SIGID" name="SIGID" important="True" supported="True" descr="Signature Identifier. 993-19999 valid for default signatures. 20000-50000 valid for user signatures.where parameter" required="yes" key="true" />
      <member type="STRING-SigName" name="SigName" important="True" supported="True" descr="Official name of the signature." />
      <member type="STRING-SigStringInfo" name="SigStringInfo" important="False" supported="True" descr="Extra information included in the alarm message." />
      <member type="STRING-SigVersion" name="SigVersion" important="True" supported="True" descr="Signature update version of signature" />
      <member type="ENUM(AxBx)-StorageKey-STRING.ICMP" name="StorageKey" important="True" supported="True" descr="Type of Address Key used to store persistent data." required="yes" default="AxBx" />
      <member type="NUMBER(0-255)-SubSig" name="SubSig" important="True" supported="True" descr="Sub-Signature ID.  Denotes a specific variant of a signature." default="0" key="true" />
      <member type="ENUM(xxxx)-SummaryKey-STRING.ICMP" name="SummaryKey" important="False" supported="True" descr="The Storage Type on which to summarize this signature." required="yes" default="xxxx" />
      <member type="NUMBER(0-1000)-ThrottleInterval" name="ThrottleInterval" important="False" supported="True" descr="Number of seconds defining an Alarm Throttle interval.  This is used with the AlarmThrottle parameter to tune special alarm limiters." default="30" />
      <member type="ENUM(True,False)-WantFrag" name="WantFrag" important="True" supported="True" descr="True if a fragment is desired.  False if a fragment is not desired.  Any for either." />
    </tArray>
    <tStruct typeName="STRING.ICMP" SigMemory="4291">
      <member type="Version" name="version" descr="Engine Version" />
      <member type="STRING.ICMP-Signatures" name="signatures" descr="Generic UDP based string search Engine" />
    </tStruct>
    <tStruct typeName="SystemVariables">
      <member type="SET(RANGE(1-65535))" name="WEBPORTS" required="true" descr="Defines the ports associated with the web service"/>
    </tStruct>
    <tInteger typeName="NUMBER(0-65535)-ShunTime" min="0" max="65535" type="unsigned" />
    <tStruct typeName="ShunEvent">
      <member type="NUMBER(0-65535)-ShunTime" name="ShunTime" required="true" descr="The time duration of the shun event in minutes" />
    </tStruct>
  </typedefs>
  <data version="128MB.sdf v5">
    <item type="SystemVariables" descr="User modifiable system variables">
      <struct name="systemVariables">
        <var name="WEBPORTS" default="80,3128,8000,8010,8080,8888,24326"></var>
      </struct>
    </item>
    <item type="ShunEvent" descr="Shun Event configuration tokens">
      <struct name="ShunEvent">
        <var name="ShunTime" variableType="value" default="30" />
      </struct>
    </item>
    <item type="OTHER">
      <struct name="OTHER">
        <var name="version" protected="true">4.0</var>
        <array name="signatures">
          <entry dontDelete="true" nda="false" sfr="75">
            <var name="SigName" default="Frag Overlap" protected="true" />
            <var name="SIGID" default="1201" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default="IP Fragment Overlap" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="30" />
            <var name="Protocol" default="FRAG" />
            <var name="StorageKey" default="Axxx" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
            <var name="WantFrag" default="False" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="95">
            <var name="SigName" default="DGram too long" protected="true" />
            <var name="SIGID" default="1202" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default="IP Fragment Overrun - Dgram too Long" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="FRAG" />
            <var name="StorageKey" default="Axxx" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
            <var name="WantFrag" default="False" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="95">
            <var name="SigName" default="Frag Overwrite" protected="true" />
            <var name="SIGID" default="1203" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default="IP Fragment Overwrite - Data overwritten" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="30" />
            <var name="Protocol" default="FRAG" />
            <var name="StorageKey" default="Axxx" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
            <var name="WantFrag" default="False" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="95">
            <var name="SigName" default="Half-open Syn" protected="true" />
            <var name="SIGID" default="3050" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="1.0" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Protocol" default="TCP" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="Axxx" />
            <var name="SynFloodMaxEmbrionic" default="50" />
            <var name="ThrottleInterval" default="15" />
          </entry>
        </array>
        <array name="IOS-supported-signatures">
          <entry dontDelete="true">
            <var name="SIGID" default="1201" protected="true" />
            <var name="SubSig" default="0" protected="true" />
          </entry>
          <entry dontDelete="true">
            <var name="SIGID" default="1202" protected="true" />
            <var name="SubSig" default="0" protected="true" />
          </entry>
          <entry dontDelete="true">
            <var name="SIGID" default="1203" protected="true" />
            <var name="SubSig" default="0" protected="true" />
          </entry>
          <entry dontDelete="true">
            <var name="SIGID" default="1204" protected="true" />
            <var name="SubSig" default="0" protected="true" />
          </entry>
          <entry dontDelete="true">
            <var name="SIGID" default="1205" protected="true" />
            <var name="SubSig" default="0" protected="true" />
          </entry>
          <entry dontDelete="true">
            <var name="SIGID" default="1206" protected="true" />
            <var name="SubSig" default="0" protected="true" />
          </entry>
          <entry dontDelete="true">
            <var name="SIGID" default="1207" protected="true" />
            <var name="SubSig" default="0" protected="true" />
          </entry>
          <entry dontDelete="true">
            <var name="SIGID" default="1208" protected="true" />
            <var name="SubSig" default="0" protected="true" />
          </entry>
          <entry dontDelete="true">
            <var name="SIGID" default="3050" protected="true" />
            <var name="SubSig" default="0" protected="true" />
          </entry>
        </array>
      </struct>
    </item>
    <item type="STRING.ICMP">
      <struct name="STRING.ICMP">
        <var name="version" protected="true">4.0</var>
        <array name="signatures">
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="Nachi Worm ICMP Echo Request" protected="true" />
            <var name="SIGID" default="2156" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm">alarm</var>
            <var name="SigVersion" default="S54" />
            <var name="SigStringInfo" default="Nachi ICMP" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="Protocol" default="CUSTOM" />
            <var name="RegexString" protected="true" default="\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" />
            <var name="ServicePorts" default="8" />
            <var name="StorageKey" default="AxBx" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
        </array>
      </struct>
    </item>
    <item type="STRING.UDP">
      <struct name="STRING.UDP">
        <var name="version" protected="true">4.0</var>
        <array name="signatures">
          <entry dontDelete="true" nda="false" sfr="80">
            <var name="SigName" default="Back Orifice Ping" protected="true" />
            <var name="SIGID" default="4060" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm">alarm</var>
            <var name="SigVersion" default="S10" />
            <var name="SigStringInfo" default="boping packet header (standard)" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MaxInspectLength" default="7" />
            <var name="Protocol" default="UDP" />
            <var name="RegexString" protected="true" default="[\xCE][\x63][\xD1][\xD2][\x16][\xE7][\x13][\xCF]" />
            <var name="ServicePorts" default="31337" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="80">
            <var name="SigName" default="Back Orifice Ping" protected="true" />
            <var name="SIGID" default="4060" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S173" />
            <var name="SigStringInfo" default="boping packet header (non-standard)" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MaxInspectLength" default="7" />
            <var name="Protocol" default="UDP" />
            <var name="RegexString" protected="true" default="[\x06][\x20][\x8e][\x9d][\x87][\x68][\xe0][\x4d]" />
            <var name="ServicePorts" default="31337,31338" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="Deep Throat Response" protected="true" />
            <var name="SIGID" default="4607" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S30" />
            <var name="SigStringInfo" default="My Mouth is Open" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="Protocol" default="UDP" />
            <var name="RegexString" protected="true" default="[Mm][Yy][ ][Mm][Oo][Uu][Tt][Hh][ ][Ii][Ss][ ][Oo][Pp][Ee][Nn]" />
            <var name="ServicePorts" default="41" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="Deep Throat Response" protected="true" />
            <var name="SIGID" default="4607" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S30" />
            <var name="SigStringInfo" default="My Mouth is Open" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="Protocol" default="UDP" />
            <var name="RegexString" protected="true" default="[Mm][Yy][ ][Mm][Oo][Uu][Tt][Hh][ ][Ii][Ss][ ][Oo][Pp][Ee][Nn]" />
            <var name="ServicePorts" default="2140" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="Deep Throat Response" protected="true" />
            <var name="SIGID" default="4607" protected="true" />
            <var name="SubSig" default="2" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S30" />
            <var name="SigStringInfo" default="My Mouth is Open" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="Protocol" default="UDP" />
            <var name="RegexString" protected="true" default="[Mm][Yy][ ][Mm][Oo][Uu][Tt][Hh][ ][Ii][Ss][ ][Oo][Pp][Ee][Nn]" />
            <var name="ServicePorts" default="3150" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="Deep Throat Response" protected="true" />
            <var name="SIGID" default="4607" protected="true" />
            <var name="SubSig" default="3" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm">alarm</var>
            <var name="SigVersion" default="S30" />
            <var name="SigStringInfo" default="My Mouth is Open" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="Protocol" default="UDP" />
            <var name="RegexString" protected="true" default="[Mm][Yy][ ][Mm][Oo][Uu][Tt][Hh][ ][Ii][Ss][ ][Oo][Pp][Ee][Nn]" />
            <var name="ServicePorts" default="6771" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="Deep Throat Response" protected="true" />
            <var name="SIGID" default="4607" protected="true" />
            <var name="SubSig" default="4" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm">alarm</var>
            <var name="SigVersion" default="S30" />
            <var name="SigStringInfo" default="My Mouth is Open" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="Protocol" default="UDP" />
            <var name="RegexString" protected="true" default="[Mm][Yy][ ][Mm][Oo][Uu][Tt][Hh][ ][Ii][Ss][ ][Oo][Pp][Ee][Nn]" />
            <var name="ServicePorts" default="60000" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="95">
            <var name="SigName" default="Trinoo (UDP)" protected="true" />
            <var name="SIGID" default="4608" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S30" />
            <var name="SigStringInfo" default="trinoo (UDP)" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="UDP" />
            <var name="RegexString" protected="true" default="[Tt][Rr][Ii][Nn][Oo0][Oo0]" />
            <var name="ServicePorts" default="27444" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="95">
            <var name="SigName" default="Trinoo (UDP)" protected="true" />
            <var name="SIGID" default="4608" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm">alarm</var>
            <var name="SigVersion" default="S30" />
            <var name="SigStringInfo" default="trinoo (UDP)" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="UDP" />
            <var name="RegexString" protected="true" default="[Tt][Rr][Ii][Nn][Oo0][Oo0]" />
            <var name="ServicePorts" default="34555" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="95">
            <var name="SigName" default="Trinoo (UDP)" protected="true" />
            <var name="SIGID" default="4608" protected="true" />
            <var name="SubSig" default="2" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm">alarm</var>
            <var name="SigVersion" default="S30" />
            <var name="SigStringInfo" default="trinoo (UDP)" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="UDP" />
            <var name="RegexString" protected="true" default="[Tt][Rr][Ii][Nn][Oo0][Oo0]" />
            <var name="ServicePorts" default="35555" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="KaZaA v2 UDP Client Probe" protected="true" />
            <var name="SIGID" default="11000" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm">alarm</var>
            <var name="SigVersion" default="S37" />
            <var name="SigStringInfo" default="KaZaA" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="Protocol" default="UDP" />
            <var name="RegexString" protected="true" default="[Kk][Aa][Zz][Aa][Aa]" />
            <var name="ServicePorts" default="1214" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="KaZaA v2 UDP Client Probe" protected="true" />
            <var name="SIGID" default="11000" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm">alarm</var>
            <var name="SigVersion" default="S37" />
            <var name="SigStringInfo" default="KaZaA" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="Protocol" default="UDP" />
            <var name="RegexString" protected="true" default="[Kk][Aa][Zz][Aa][Aa]" />
            <var name="ServicePorts" default="1531" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="KaZaA v2 UDP Client Probe" protected="true" />
            <var name="SIGID" default="11000" protected="true" />
            <var name="SubSig" default="2" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm">alarm</var>
            <var name="SigVersion" default="S136" />
            <var name="SigStringInfo" default="KaZaA" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="Protocol" default="UDP" />
            <var name="RegexString" protected="true" default="[Kk][Aa][Zz][Aa][Aa]" />
            <var name="ServicePorts" default="3861" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="AIM Client DNS request" protected="true" />
            <var name="SIGID" default="11207" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="informational" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S139" />
            <var name="SigStringInfo" default="login.oscar.aol.com" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="Protocol" default="UDP" />
            <var name="RegexString" protected="true" default="\x05[Ll][Oo][Gg][Ii][Nn]\x05[Oo][Ss][Cc][Aa][Rr]\x03[Aa][Oo][Ll]\x03[Cc][Oo][Mm]\x00\x00\x01\x00\x01" />
            <var name="ServicePorts" default="53" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="Yahoo Messenger Client DNS Request" protected="true" />
            <var name="SIGID" default="11208" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="informational" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S139" />
            <var name="SigStringInfo" default="msg.yahoo.com" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="Protocol" default="UDP" />
            <var name="RegexString" protected="true" default="\x03[Mm][Ss][Gg]\x05[Yy][Aa][Hh][Oo][Oo]\x03[Cc][Oo][Mm]\x00\x00\x01\x00\x01" />
            <var name="ServicePorts" default="53" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="MSN Messenger Client DNS Request" protected="true" />
            <var name="SIGID" default="11209" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="informational" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S139" />
            <var name="SigStringInfo" default="messenger.msn.com" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="Protocol" default="UDP" />
            <var name="RegexString" protected="true" default="\x09[Mm][Ee][Ss][Ss][Ee][Nn][Gg][Ee][Rr]\x03[Mm][Ss][Nn]\x03[Cc][Oo][Mm]\x00\x00\x01\x00\x01" />
            <var name="ServicePorts" default="53" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
        </array>
      </struct>
    </item>
    <item type="STRING.TCP">
      <struct name="STRING.TCP">
        <var name="version" protected="true">4.0</var>
         <array name="signatures">
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="Sober Virus Activity" protected="true"></var>
            <var name="SIGID" default="3137" protected="true"></var>
            <var name="SubSig" default="0" protected="true"></var>
            <var name="AlarmSeverity" default="high"></var>
            <var name="Enabled" default="True"></var>
            <var name="EventAction" default="alarm">alarm|drop|reset</var>
            <var name="SigVersion" default="S77"></var>
            <var name="SigStringInfo" default="Sober.D .exe Email Attachment"></var>
            <var name="AlarmThrottle" default="Summarize"></var>
            <var name="Direction" protected="true" default="ToService"></var>
            <var name="MinHits" default="1"></var>
            <var name="Protocol" default="TCP"></var>
            <var name="RegexString" protected="true" default="unolVamKObp6JoaFVaqKuYnaSoqWhnVV"></var>
            <var name="ServicePorts" default="25"></var>
            <var name="StorageKey" default="STREAM"></var>
            <var name="SummaryKey" default="Axxx"></var>
            <var name="ThrottleInterval" default="15"></var>
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="Sober Virus Activity" protected="true" />
            <var name="SIGID" default="3137" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm">alarm|drop|reset</var>
            <var name="SigVersion" default="S83" />
            <var name="SigStringInfo" default="Sober.F .exe Email Attachment" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="\x6C\x70\x32\x59\x6A\x45\x69\x62\x6C\x5A\x74\x49\x6D\x34\x75\x4A\x6C\x56\x74\x61\x53\x4A\x75\x68\x6D\x35\x79\x4E\x6C\x55\x69\x4A\x6E\x70\x69\x61\x6C\x35\x79\x4E" />
            <var name="ServicePorts" default="25" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="Sober Virus Activity" protected="true" />
            <var name="SIGID" default="3137" protected="true" />
            <var name="SubSig" default="2" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm">alarm|drop|reset</var>
            <var name="SigVersion" default="S128" />
            <var name="SigStringInfo" default="Sober.I .pif Email Attachment" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="\x34\x30\x7a\x52\x4e\x31\x78\x39\x46\x41\x31\x4a\x66\x62\x48\x6c\x4e\x30\x7a\x52\x4e\x0d\x0a\x68\x70\x4f\x67\x72\x62\x72\x48\x62" />
            <var name="ServicePorts" default="25" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="72">
            <var name="SigName" default="Sober Virus Activity" protected="true"></var>
            <var name="SIGID" default="3137" protected="true"></var>
            <var name="SubSig" default="3" protected="true"></var>
            <var name="AlarmSeverity" default="high"></var>
            <var name="Enabled" default="True"></var>
            <var name="EventAction" default="alarm">alarm|drop|reset</var>
            <var name="SigVersion" default="S162"></var>
            <var name="SigStringInfo" default="Sober.S .Zip Email Attachment"></var>
            <var name="AlarmThrottle" default="Summarize"></var>
            <var name="Direction" protected="true" default="ToService"></var>
            <var name="MinHits" default="1"></var>
            <var name="Protocol" default="TCP"></var>
            <var name="RegexString" protected="true" default="\x32\x62\x5a\x47\x76\x57\x50\x42\x50\x59\x50\x53\x4e\x4d\x30\x7a\x52\x31\x56\x58\x49\x32\x50\x6d\x70\x4e\x4e\x4d\x35\x69\x6c\x41"></var>
            <var name="ServicePorts" default="25"></var>
            <var name="StorageKey" default="STREAM"></var>
            <var name="SummaryKey" default="Axxx"></var>
            <var name="ThrottleInterval" default="15"></var>
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="Sober Virus Activity" protected="true"></var>
            <var name="SIGID" default="3137" protected="true"></var>
            <var name="SubSig" default="4" protected="true"></var>
            <var name="AlarmSeverity" default="high"></var>
            <var name="Enabled" default="True"></var>
            <var name="EventAction" default="alarm">alarm|drop|reset</var>
            <var name="SigVersion" default="S176"></var>
            <var name="SigStringInfo" default="Sober.K pop3 download"></var>
            <var name="AlarmThrottle" default="Summarize"></var>
            <var name="Direction" protected="true" default="FromService"></var>
            <var name="MinHits" default="1"></var>
            <var name="Protocol" default="TCP"></var>
            <var name="RegexString" protected="true" default="\x61\x36\x67\x43\x41\x43\x71\x33\x41\x41\x41\x41\x73\x41\x49\x41\x4a\x67\x55\x41\x75\x50\x2b\x68\x0d\x0a\x4b\x70\x41\x41\x4a\x51"></var>
            <var name="ServicePorts" default="110"></var>
            <var name="StorageKey" default="STREAM"></var>
            <var name="SummaryKey" default="Axxx"></var>
            <var name="ThrottleInterval" default="15"></var>
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="Sober Virus Activity" protected="true"></var>
            <var name="SIGID" default="3137" protected="true"></var>
            <var name="SubSig" default="5" protected="true"></var>
            <var name="AlarmSeverity" default="high"></var>
            <var name="Enabled" default="True"></var>
            <var name="EventAction" default="alarm">alarm|drop|reset</var>
            <var name="SigVersion" default="S194"></var>
            <var name="SigStringInfo" default="Sober.AC .zip Email Attachment"></var>
            <var name="AlarmThrottle" default="Summarize"></var>
            <var name="Direction" protected="true" default="ToService"></var>
            <var name="MinHits" default="1"></var>
            <var name="Protocol" default="TCP"></var>
            <var name="RegexString" protected="true" default="\x37\x4e\x55\x69\x66\x2b\x42\x6a\x4d\x42\x58\x41\x41\x58\x2b\x46\x6f\x52\x4b\x69\x65\x68\x53\x44\x4c\x4e\x75\x5a\x45\x64\x73\x77"></var>
            <var name="ServicePorts" default="25"></var>
            <var name="StorageKey" default="STREAM"></var>
            <var name="SummaryKey" default="Axxx"></var>
            <var name="ThrottleInterval" default="15"></var>
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="Sober Virus Activity" protected="true"></var>
            <var name="SIGID" default="3137" protected="true"></var>
            <var name="SubSig" default="6" protected="true"></var>
            <var name="AlarmSeverity" default="high"></var>
            <var name="Enabled" default="True"></var>
            <var name="EventAction" default="alarm">alarm|drop|reset</var>
            <var name="SigVersion" default="S203"></var>
            <var name="SigStringInfo" default="Sober.AG .zip Email Attachment"></var>
            <var name="AlarmThrottle" default="Summarize"></var>
            <var name="Direction" protected="true" default="ToService"></var>
            <var name="MinHits" default="1"></var>
            <var name="Protocol" default="TCP"></var>
            <var name="RegexString" protected="true" default="\x5a\x74\x6b\x30\x54\x56\x37\x7a\x2b\x6e\x2b\x56\x39\x7a\x54\x4e\x49\x4d\x73\x45\x6c\x67\x59\x53\x49\x5a\x2b\x35"></var>
            <var name="ServicePorts" default="25"></var>
            <var name="StorageKey" default="STREAM"></var>
            <var name="SummaryKey" default="Axxx"></var>
            <var name="ThrottleInterval" default="15"></var>
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="NetBus" protected="true" />
            <var name="SIGID" default="3116" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S12" />
            <var name="SigStringInfo" default="NetBus" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Nn][Ee][Tt][Bb][Uu][Ss]" />
            <var name="ServicePorts" default="12345-12346,20034" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="80">
            <var name="SigName" default="KLEZ worm" protected="true" />
            <var name="SIGID" default="3117" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm">alarm</var>
            <var name="SigVersion" default="S13" />
            <var name="SigStringInfo" default="name=Gn.Exe" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[cC][Oo][Nn][Tt][Ee][Nn][Tt][-][tT][Yy][Pp][Ee][:][ \t][Aa][Uu][Dd][Ii][Oo][/\\][Xx][-][Ww][Aa][Vv][;][ \t][Nn][Aa][Mm][Ee][=][\x22\x27]?[Gg][Nn][.][Ee][Xx][Ee]" />
            <var name="ServicePorts" default="25" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="KLEZ worm" protected="true" />
            <var name="SIGID" default="3117" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm">alarm</var>
            <var name="SigVersion" default="S13" />
            <var name="SigStringInfo" default="name=Gn.Exe" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[cC][Oo][Nn][Tt][Ee][Nn][Tt][-][tT][Yy][Pp][Ee][:][ \t][Aa][Uu][Dd][Ii][Oo][/\\][Xx][-][Ww][Aa][Vv][;][ \t][Nn][Aa][Mm][Ee][=][\x22\x27]?[Gg][Nn][.][Ee][Xx][Ee]" />
            <var name="ServicePorts" default="109-110,143,220" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="ANTS Virus" protected="true" />
            <var name="SIGID" default="3120" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S13" />
            <var name="SigStringInfo" default="Attachment ANTS3SET.EXE" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="filename[=][\x22\x27]?[Aa][Nn][Tt][Ss]3[Ss][Ee][Tt][.][Ee][Xx][Ee]" />
            <var name="ServicePorts" default="25" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="ANTS Virus" protected="true" />
            <var name="SIGID" default="3120" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S13" />
            <var name="SigStringInfo" default="Attachment ANTS3SET.EXE" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="filename[=][\x22\x27]?[Aa][Nn][Tt][Ss]3[Ss][Ee][Tt][.][Ee][Xx][Ee]" />
            <var name="ServicePorts" default="109-110,143,220" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="Novarg / Mydoom Virus Mail Attachment" protected="true" />
            <var name="SIGID" default="3132" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm">alarm</var>
            <var name="SigVersion" default="S67" />
            <var name="SigStringInfo" default=".doc / .scr / .pif / .exe / .cmd" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[h][+][i][Y][/][U][N][h][y][B][K][Z][Y][A][A][F][N][O][A][A][A][A][g][A][A][A][J][g][E][A][x][e][6][H][\r][\n]" />
            <var name="ServicePorts" default="25" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="Novarg / Mydoom Virus Mail Attachment" protected="true" />
            <var name="SIGID" default="3132" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm">alarm</var>
            <var name="SigVersion" default="S67" />
            <var name="SigStringInfo" default=".zip" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[C][A][A][A][A][m][A][Q][D][F][7][o][c][C][k][g][B][Q][J][k][o][A][Q][A][P][9][s][m][m][a][L][B][A][E][\r][\n]" />
            <var name="ServicePorts" default="25" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="MyDoom Virus Activity" protected="true" />
            <var name="SIGID" default="3135" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S73" />
            <var name="SigStringInfo" default="MyDoom.F com/exe/src" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="\x52\x4d\x52\x44\x77\x30\x4c\x47\x6d\x61\x70\x6d\x6b\x6b\x48\x42\x51\x4d\x42\x4e\x4d\x30\x7a\x62\x4c\x38\x4d\x2f\x54\x73\x35\x4e" />
            <var name="ServicePorts" default="25" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="Lovgate Worm Activity" protected="true" />
            <var name="SIGID" default="3141" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm">alarm</var>
            <var name="SigVersion" default="S94" />
            <var name="SigStringInfo" default="Lovgate.Z zip" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="\x43\x31\x54\x46\x41\x65\x62\x2f\x70\x4e\x6d\x77\x5a\x6f\x0d\x0a\x39\x6e\x37\x56\x61\x44\x68\x2f\x48\x6b\x31\x57\x33\x56\x69\x55" />
            <var name="ServicePorts" default="25" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="Sasser Worm Activity" protected="true" />
            <var name="SIGID" default="3142" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm">alarm</var>
            <var name="SigVersion" default="S92" />
            <var name="SigStringInfo" default="220 OK" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="\x32\x32\x30\x20\x4f\x4b\x0a" />
            <var name="ServicePorts" default="1022,1023,5554" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="FTP CWD ~root" protected="true" />
            <var name="SIGID" default="3152" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1" />
            <var name="SigStringInfo" default="CWD ~root" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="^[ \t]*[Cc][Ww][Dd][ \t]+[~]root" />
            <var name="ServicePorts" default="21" />
            <var name="StorageKey" default="STREAM" />
            <var name="StripTelnetOptions" protected="true" default="True" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="Finger Bomb" protected="true" />
            <var name="SIGID" default="3450" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="1.0" />
            <var name="SigStringInfo" default="Finger Bomb" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="@@@" />
            <var name="ServicePorts" default="79" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="71">
            <var name="SigName" default="Possible Heap Payload Construction" protected="true"></var>
            <var name="SIGID" default="5477" protected="true"></var>
            <var name="SubSig" default="2" protected="true"></var>
            <var name="AlarmSeverity" default="high"></var>
            <var name="Enabled" default="True"></var>
            <var name="EventAction" default="alarm">alarm|drop|reset</var>
            <var name="SigVersion" default="S207"></var>
            <var name="SigStringInfo" default="unescape(%uxxxx%uxxxx%uxxxx"></var>
            <var name="AlarmThrottle" default="Summarize"></var>
            <var name="Direction" protected="true" default="FromService"></var>
            <var name="MinHits" default="1"></var>
            <var name="Protocol" default="TCP"></var>
            <var name="RegexString" protected="true" default="[Uu][Nn][Ee][Ss][Cc][Aa][Pp][Ee][(]['\x22][%][Uu][0-9A-Fa-f][0-9A-Fa-f][0-9A-Fa-f][0-9A-Fa-f][%][Uu][0-9A-Fa-f][0-9A-Fa-f][0-9A-Fa-f][0-9A-Fa-f][%][Uu][0-9A-Fa-f][0-9A-Fa-f][0-9A-Fa-f][0-9A-Fa-f]"></var>
            <var name="ServicePorts" default="#WEBPORTS"></var>
            <var name="StorageKey" default="STREAM"></var>
            <var name="SummaryKey" default="Axxx"></var>
            <var name="ThrottleInterval" default="15"></var>
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="MyTOB Virus Activity" protected="true"></var>
            <var name="SIGID" default="5489" protected="true"></var>
            <var name="SubSig" default="7" protected="true"></var>
            <var name="AlarmSeverity" default="high"></var>
            <var name="Enabled" default="True"></var>
            <var name="EventAction" default="alarm">alarm|drop|reset</var>
            <var name="SigVersion" default="S204"></var>
            <var name="SigStringInfo" default="MyTob.MX"></var>
            <var name="AlarmThrottle" default="Summarize"></var>
            <var name="Direction" protected="true" default="ToService"></var>
            <var name="MinHits" default="1"></var>
            <var name="Protocol" default="TCP"></var>
            <var name="RegexString" protected="true" default="\x66\x47\x4e\x51\x7a\x6e\x65\x42\x77\x61\x4b\x51\x35\x4b\x35\x6b\x43\x66\x71\x4f\x66\x2b\x53\x75\x4c\x72\x39\x6e\x46\x4c\x77\x79"></var>
            <var name="ServicePorts" default="25"></var>
            <var name="StorageKey" default="STREAM"></var>
            <var name="SummaryKey" default="Axxx"></var>
            <var name="ThrottleInterval" default="15"></var>
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="ZOTOB Worm Activity" protected="true" />
            <var name="SIGID" default="5570" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm">alarm|reset</var>
            <var name="SigVersion" default="S185" />
            <var name="SigStringInfo" default="ZOTOB.D" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="\x64\xb8\xe6\xf4\x97\x83\xcb\x0f\x72\x2c\x38\xea\xd4\x81\x7f\x44\x57\x14\xbf\x7d\xa6\x46\x41\xfc\x55\x14\xb9\x46\x57\x14\xbf\x7d" />
            <var name="ServicePorts" default="445" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="RBOT.CBQ Worm Activity" protected="true" />
            <var name="SIGID" default="5571" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm">alarm|reset</var>
            <var name="SigVersion" default="S185" />
            <var name="SigStringInfo" default="RBOT.CBQ" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="\xb5\x71\xc4\x43\x1e\x34\xce\x3a\x18\x37\xef\xc3\x22\xa1\x20\x1f\x6c\x10\x8f\x68\x3d\xf4\xef\x51\x92\xf9\x4f\xbc\x46\xe9\x05\xdc" />
            <var name="ServicePorts" default="445" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="72">
            <var name="SigName" default="Back Door Donald Dick" protected="true" />
            <var name="SIGID" default="9479" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S104" />
            <var name="SigStringInfo" default="Ping_" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Pp][Ii][Nn][Gg][_]" />
            <var name="ServicePorts" default="23476" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="64">
            <var name="SigName" default="Back Door Mavericks Matrix" protected="true" />
            <var name="SIGID" default="9480" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S104" />
            <var name="SigStringInfo" default="Mavericks Matrix" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MaxInspectLength" default="16" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Mm][Aa][Vv][Ee][Rr][Ii][Cc][Kk][Ss][ ][Mm][Aa][Tt][Rr][Ii][Xx]" />
            <var name="ServicePorts" default="1269" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="72">
            <var name="SigName" default="Back Door Massaker" protected="true" />
            <var name="SIGID" default="9481" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S104" />
            <var name="SigStringInfo" default="(Victim)" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MaxInspectLength" default="15" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[(][Vv][Ii][Cc][Tt][Ii][Mm][)]" />
            <var name="ServicePorts" default="7119" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="72">
            <var name="SigName" default="Back Door Drat" protected="true" />
            <var name="SIGID" default="9482" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S104" />
            <var name="SigStringInfo" default="Welcome to Darat'z" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Ww][Ee][Ll][Cc][Oo][Mm][Ee][ ][Tt][Oo][ ][Dd][Aa][Rr][Aa][Tt]['][Zz]" />
            <var name="ServicePorts" default="48" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="72">
            <var name="SigName" default="Back Door DTr" protected="true" />
            <var name="SIGID" default="9483" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S104" />
            <var name="SigStringInfo" default="dtr.===" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MaxInspectLength" default="7" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Dd][Tt][Rr].===" />
            <var name="ServicePorts" default="10001" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="72">
            <var name="SigName" default="Back Door MNEAH Trojan" protected="true" />
            <var name="SIGID" default="9484" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S104" />
            <var name="SigStringInfo" default="Mneah Remote" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Mm][Nn][Ee][Aa][Hh][ ][Rr][Ee][Mm][Oo][Tt][Ee]" />
            <var name="ServicePorts" default="4666,5401,5402" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="72">
            <var name="SigName" default="Back Door Eclypse" protected="true" />
            <var name="SIGID" default="9485" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S104" />
            <var name="SigStringInfo" default="EclYpse 's FTP" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MaxInspectLength" default="23" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Ee][Cc][Ll][Yy][Pp][Ss][Ee][ ]['][Ss][ ][Ff][Tt][Pp]" />
            <var name="ServicePorts" default="3791" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="72">
            <var name="SigName" default="Back Door M2 Trojan" protected="true" />
            <var name="SIGID" default="9486" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S104" />
            <var name="SigStringInfo" default="SH@H Server" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MaxInspectLength" default="11" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Ss][Hh][@][Hh][ ][Ss][Ee][Rr][Vv][Ee][Rr]" />
            <var name="ServicePorts" default="41626" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="72">
            <var name="SigName" default="Back Door Intruzzo" protected="true" />
            <var name="SIGID" default="9487" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S104" />
            <var name="SigStringInfo" default="verpc," />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Vv][Ee][Rr][Pp][Cc][,]" />
            <var name="ServicePorts" default="22784,1984,2418" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="72">
            <var name="SigName" default="Back Door FC Trojan" protected="true" />
            <var name="SIGID" default="9488" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S104" />
            <var name="SigStringInfo" default="WhatIsIt" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MaxInspectLength" default="10" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Ww][Hh][Aa][Tt][Ii][Ss][Ii][Tt]" />
            <var name="ServicePorts" default="146" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="72">
            <var name="SigName" default="Back Door Insane" protected="true" />
            <var name="SIGID" default="9489" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S104" />
            <var name="SigStringInfo" default="Insane Network" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MaxInspectLength" default="14" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Ii][Nn][Ss][Aa][Nn][Ee][ ][Nn][Ee][Tt][Ww][Oo][Rr][Kk]" />
            <var name="ServicePorts" default="63536,2000" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="64">
            <var name="SigName" default="Back Door Incommand" protected="true" />
            <var name="SIGID" default="9491" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S104" />
            <var name="SigStringInfo" default="InCommand" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Ii][Nn][Cc][Oo][Mm][Mm][Aa][Nn][Dd]" />
            <var name="ServicePorts" default="9400" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="72">
            <var name="SigName" default="Back Door Hydroleak" protected="true" />
            <var name="SIGID" default="9492" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S104" />
            <var name="SigStringInfo" default="windows folder:" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Ww][Ii][Nn][Dd][Oo][Ww][Ss][ ][Ff][Oo][Ll][Dd][Ee][Rr][:]" />
            <var name="ServicePorts" default="954" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="72">
            <var name="SigName" default="Back Door Hostcontrol" protected="true" />
            <var name="SIGID" default="9493" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S104" />
            <var name="SigStringInfo" default="--&gt;Host Control" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MaxInspectLength" default="30" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[-][-][&gt;][Hh][Oo][Ss][Tt][ ][Cc][Oo][Nn][Tt][Rr][Oo][Ll]" />
            <var name="ServicePorts" default="11051" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="72">
            <var name="SigName" default="Back Door Hackers World" protected="true" />
            <var name="SIGID" default="9495" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S104" />
            <var name="SigStringInfo" default="HACKWORLD" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Hh][Aa][Cc][Kk][Ww][Oo][Rr][Ll][Dd]" />
            <var name="ServicePorts" default="1243" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="72">
            <var name="SigName" default="Back Door Glacier" protected="true" />
            <var name="SIGID" default="9496" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S104" />
            <var name="SigStringInfo" default="Desktop:" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Dd][Ee][Ss][Kk][Tt][Oo][Pp][:]" />
            <var name="ServicePorts" default="7718,7626,1826" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="72">
            <var name="SigName" default="Back Door Girlfriend" protected="true" />
            <var name="SIGID" default="9497" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S104" />
            <var name="SigStringInfo" default="Girlfriend Server" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Gg][Ii][Rr][Ll][Ff][Rr][Ii][Ee][Nn][Dd][ ][Ss][Ee][Rr][Vv][Ee][Rr]" />
            <var name="ServicePorts" default="21554" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="72">
            <var name="SigName" default="Back Door Ghost" protected="true" />
            <var name="SIGID" default="9498" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S104" />
            <var name="SigStringInfo" default="ver:Ghost" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MaxInspectLength" default="9" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Vv][Ee][Rr][:][Gg][Hh][Oo][Ss][Tt]" />
            <var name="ServicePorts" default="9696" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="72">
            <var name="SigName" default="Back Door Kid Terror" protected="true" />
            <var name="SIGID" default="9499" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S104" />
            <var name="SigStringInfo" default="Kid Terror" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Kk][Ii][Dd][ ][Tt][Ee][Rr][Rr][Oo][Rr]" />
            <var name="ServicePorts" default="21554" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="72">
            <var name="SigName" default="Back Door Gatecrasher" protected="true" />
            <var name="SIGID" default="9500" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S104" />
            <var name="SigStringInfo" default="GateCrasher" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MaxInspectLength" default="11" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Gg][Aa][Tt][Ee][Cc][Rr][Aa][Ss][Hh][Ee][Rr]" />
            <var name="ServicePorts" default="6969" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="55">
            <var name="SigName" default="Back Door Last2000" protected="true" />
            <var name="SIGID" default="9517" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S114" />
            <var name="SigStringInfo" default="lastdrive" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Ll][Aa][Ss][Tt][Dd][Rr][Ii][Vv][Ee]" />
            <var name="ServicePorts" default="1415" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="64">
            <var name="SigName" default="Back Door Event Horizon" protected="true" />
            <var name="SIGID" default="9518" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S111" />
            <var name="SigStringInfo" default="execute" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MaxInspectLength" default="7" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Ee][Xx][Ee][Cc][Uu][Tt][Ee]" />
            <var name="ServicePorts" default="4488" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="64">
            <var name="SigName" default="Back Door Latinus" protected="true" />
            <var name="SIGID" default="9519" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S111" />
            <var name="SigStringInfo" default="exploring -" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Ee][Xx][Pp][Ll][Oo][Rr][Ii][Nn][Gg][ ][-]" />
            <var name="ServicePorts" default="24289" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="47">
            <var name="SigName" default="Back Door Latinus" protected="true" />
            <var name="SIGID" default="9519" protected="true" />
            <var name="SubSig" default="2" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S115" />
            <var name="SigStringInfo" default="0[0-9][0-9]" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MaxInspectLength" default="3" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="0[0-9][0-9]" />
            <var name="ServicePorts" default="1188" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="64">
            <var name="SigName" default="Back Door Masters of Paradise" protected="true" />
            <var name="SIGID" default="9522" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S111" />
            <var name="SigStringInfo" default="Harddisk" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Hh][Aa][Rr][Dd][Dd][Ii][Ss][Kk]\x01" />
            <var name="ServicePorts" default="31" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="64">
            <var name="SigName" default="Back Door Back Construction" protected="true" />
            <var name="SIGID" default="9523" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S114" />
            <var name="SigStringInfo" default="Windows*" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Ww][Ii][Nn][Dd][Oo][Ww][Ss][\x2a][\x0d][\x0a]" />
            <var name="ServicePorts" default="5401" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="64">
            <var name="SigName" default="Back Door WinCrash" protected="true" />
            <var name="SIGID" default="9524" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S114" />
            <var name="SigStringInfo" default="WinCrash" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MaxInspectLength" default="65" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Ww][Ii][Nn][Cc][Rr][Aa][Ss][Hh]" />
            <var name="ServicePorts" default="5742,2583" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="64">
            <var name="SigName" default="Back door NokNok" protected="true" />
            <var name="SIGID" default="9527" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S114" />
            <var name="SigStringInfo" default="ListApp/Spawn/Run" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="([Ss][Pp][Aa][Ww][Nn]|[Rr][Uu][Nn]|[Ll][Ii][Ss][Tt][Aa][Pp][Pp])" />
            <var name="ServicePorts" default="5400,666" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="64">
            <var name="SigName" default="Back Door War Trojan" protected="true" />
            <var name="SIGID" default="9528" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S114" />
            <var name="SigStringInfo" default="listen" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Ll][Ii][Ss][Tt][Ee][Nn]" />
            <var name="ServicePorts" default="4201" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="64">
            <var name="SigName" default="Back Door Tron" protected="true" />
            <var name="SIGID" default="9532" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S114" />
            <var name="SigStringInfo" default="REQSTFILE" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="(\x3c[Rr][Ee][Qq][Ss][Tt][Ff][Ii][Ll][Ee]\x3e|\x3C[Uu][Pp][Ll][Oo][Aa][Dd][Ii][Nn][Gg]\x3E)" />
            <var name="ServicePorts" default="58008" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="64">
            <var name="SigName" default="Back Door Trojan Spirit" protected="true" />
            <var name="SIGID" default="9533" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S114" />
            <var name="SigStringInfo" default="downloadc:" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Dd][Oo][Ww][Nn][Ll][Oo][Aa][Dd][Cc][:]" />
            <var name="ServicePorts" default="29984" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="64">
            <var name="SigName" default="Back Door TansScout" protected="true" />
            <var name="SIGID" default="9535" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S114" />
            <var name="SigStringInfo" default="ID(Ip Address)" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MaxInspectLength" default="17" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Ii][Dd][1-2]?[0-9]?[0-9][.][1-2]?[0-9]?[0-9][.][1-2]?[0-9]?[0-9][.][1-2]?[0-9]?[0-9][\x3B][ ]" />
            <var name="ServicePorts" default="1999" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="64">
            <var name="SigName" default="Back Door The Flu" protected="true" />
            <var name="SIGID" default="9536" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S114" />
            <var name="SigStringInfo" default="{E}" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="\{[Ee]\}[Cc][\x3A]" />
            <var name="ServicePorts" default="5534" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="Gnutella Client Request" protected="true" />
            <var name="SIGID" default="11001" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S44" />
            <var name="SigStringInfo" default="GNUTELLA CONNECT/" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Gg][Nn][Uu][Tt][Ee][Ll][Ll][Aa][ ][Cc][Oo][Nn][Nn][Ee][Cc][Tt][/\\]" />
            <var name="ServicePorts" default="6346-6348" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="Gnutella Server Reply" protected="true" />
            <var name="SIGID" default="11002" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S44" />
            <var name="SigStringInfo" default="GNUTELLA/" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="FromService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Gg][Nn][Uu][Tt][Ee][Ll][Ll][Aa][/]" />
            <var name="ServicePorts" default="6346-6348" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="67">
            <var name="SigName" default="KaZaA Client Activity" protected="true" />
            <var name="SIGID" default="11005" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S44" />
            <var name="SigStringInfo" default="GET /" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="GET[ \t]" />
            <var name="ServicePorts" default="1214" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="Gnucleus File Request" protected="true" />
            <var name="SIGID" default="11006" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S44" />
            <var name="SigStringInfo" default="User-Agent: gnucleus" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Uu][Ss][Ee][Rr][-][Aa][Gg][Ee][Nn][Tt][:][ ][Gg][Nn][Uu][Cc][Ll][Ee][Uu][Ss]" />
            <var name="ServicePorts" default="6346-6348" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="GTK-Gnutella File Request" protected="true" />
            <var name="SIGID" default="11012" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S44" />
            <var name="SigStringInfo" default="User-Agent: GTK-Gnutella" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Uu][Ss][Ee][Rr][-][Aa][Gg][Ee][Nn][Tt][:][ ][Gg][Tt][Kk][-][Gg][Nn][Uu][Tt][Ee][Ll][Ll][Aa]" />
            <var name="ServicePorts" default="6346-6348" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="80">
            <var name="SigName" default="eDonkey Activity" protected="true" />
            <var name="SIGID" default="11018" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S62" />
            <var name="SigStringInfo" default="\xe3" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MaxInspectLength" default="1" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[\xe3]" />
            <var name="ServicePorts" default="4242,4661,4662" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="BitTorrent Client Activity" protected="true" />
            <var name="SIGID" default="11020" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S183" />
            <var name="SigStringInfo" default="BitTorrent protocol" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MaxInspectLength" default="28" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="^[\x13][Bb][Ii][Tt][Tt][Oo][Rr][Rr][Ee][Nn][Tt][ ][Pp][Rr][Oo][Tt][Oo][Cc][Oo][Ll]" />
            <var name="ServicePorts" default="6881-6999" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="Yahoo Messenger Activity" protected="true" />
            <var name="SIGID" default="11200" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="informational" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S139" />
            <var name="SigStringInfo" default="YMSG" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="YMSG" />
            <var name="ServicePorts" default="5050" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="80">
            <var name="SigName" default="MSN Messenger Activity" protected="true" />
            <var name="SIGID" default="11201" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="informational" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S139" />
            <var name="SigStringInfo" default="MSN" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MaxInspectLength" default="10" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="MSN" />
            <var name="ServicePorts" default="1863" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="AIM / ICQ  Messenger Activity" protected="true" />
            <var name="SIGID" default="11202" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="informational" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S188" />
            <var name="SigStringInfo" default="AIM / ICQ" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" protected="true" default="ToService" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="\x2A\x01[\x00-\xFF]{4}\x00\x00\x00\x01" />
            <var name="ServicePorts" default="5190" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
        </array>
      </struct>
    </item>
    <item type="SERVICE.FTP">
      <struct name="SERVICE.FTP">
        <var name="version" protected="true">4.0</var>
        <array name="signatures">
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="FTP Improper Address" protected="true" />
            <var name="SIGID" default="3153" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="BadPortCmdAddress" default="True" />
            <var name="Direction" default="ToService" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" protected="true" default="21" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="FTP Improper port" protected="true" />
            <var name="SIGID" default="3154" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="BadPortCmdPort" default="True" />
            <var name="Direction" default="ToService" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" protected="true" default="21" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="80">
            <var name="SigName" default="FTP PASV Port Spoof" protected="true" />
            <var name="SIGID" default="3157" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" default="FromService" />
            <var name="FlipAddr" default="True" />
            <var name="isPASV" default="True" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" protected="true" default="21" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
        </array>
      </struct>
    </item>
    <item type="SERVICE.SMTP">
      <struct name="SERVICE.SMTP">
        <var name="version" protected="true">4.0</var>
        <array name="signatures">
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="SMTP To: Bounce" protected="true" />
            <var name="SIGID" default="3101" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="Direction" default="ToService" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="[Tt][Oo][ \t]*:[^\r\n\x7F-\xFF]*[|]" />
            <var name="ServicePorts" protected="true" default="25" />
            <var name="StateName" protected="true" default="SmtpCommands" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="Mimail Virus C Variant File Attachment" protected="true" />
            <var name="SIGID" default="3129" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S59" />
            <var name="SigStringInfo" default="photos.zip" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="Direction" default="ToService" />
            <var name="Protocol" default="TCP" />
            <var name="RegexString" protected="true" default="\x55\x45\x73\x44\x42\x41\x6f\x41\x41\x41\x41\x41\x41\x4a\x64\x47\x58\x79\x2b\x52\x30\x41\x6f\x68\x49\x44\x49\x41\x41\x43\x41\x79\x41\x41\x41\x4f\x41\x41\x41\x41\x63\x47\x68\x76\x64\x47\x39\x7a" />
            <var name="ServicePorts" protected="true" default="25" />
            <var name="StateName" protected="true" default="MailBody" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
        </array>
      </struct>
    </item>
    <item type="SERVICE.RPC">
      <struct name="SERVICE.RPC">
        <var name="version" protected="true">4.0</var>
        <array name="signatures">
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="RPC Port Reg" protected="true" />
            <var name="SIGID" default="6100" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="1.0" />
            <var name="SigStringInfo" default="RPC Port Reg (UDP)" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="True" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="PortMapProgram" default="100004" />
            <var name="Protocol" default="UDP" />
            <var name="RpcProcedure" default="1" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="RPC Port Reg" protected="true" />
            <var name="SIGID" default="6100" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="1.0" />
            <var name="SigStringInfo" default="RPC Port Reg (TCP)" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="True" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="PortMapProgram" default="100004" />
            <var name="Protocol" default="TCP" />
            <var name="RpcProcedure" default="1" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="RPC Port UnReg" protected="true" />
            <var name="SIGID" default="6101" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="1.0" />
            <var name="SigStringInfo" default="RPC Port UnReg (UDP)" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="True" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="PortMapProgram" default="100004" />
            <var name="Protocol" default="UDP" />
            <var name="RpcProcedure" default="2" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="RPC Port UnReg" protected="true" />
            <var name="SIGID" default="6101" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="1.0" />
            <var name="SigStringInfo" default="RPC Port UnReg (TCP)" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="True" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="PortMapProgram" default="100004" />
            <var name="Protocol" default="TCP" />
            <var name="RpcProcedure" default="2" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="RPC Port Reg Spoof" protected="true" />
            <var name="SIGID" default="6104" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="RPC Port Reg Spoof (UDP)" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="True" />
            <var name="isSpoofSrc" default="True" />
            <var name="isSweep" default="False" />
            <var name="PortMapProgram" default="100004" />
            <var name="Protocol" default="UDP" />
            <var name="RpcProcedure" default="1" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="RPC Port Reg Spoof" protected="true" />
            <var name="SIGID" default="6104" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="RPC Port Reg Spoof (TCP)" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="True" />
            <var name="isSpoofSrc" default="True" />
            <var name="isSweep" default="False" />
            <var name="PortMapProgram" default="100004" />
            <var name="Protocol" default="TCP" />
            <var name="RpcProcedure" default="1" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="RPC Port UnReg Spoof" protected="true" />
            <var name="SIGID" default="6105" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="RPC Port UnReg Spoof (UDP)" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="True" />
            <var name="isSpoofSrc" default="True" />
            <var name="isSweep" default="False" />
            <var name="PortMapProgram" default="100004" />
            <var name="Protocol" default="UDP" />
            <var name="RpcProcedure" default="2" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="RPC Port UnReg Spoof" protected="true" />
            <var name="SIGID" default="6105" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="RPC Port UnReg Spoof (TCP)" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="True" />
            <var name="isSpoofSrc" default="True" />
            <var name="isSweep" default="False" />
            <var name="PortMapProgram" default="100004" />
            <var name="Protocol" default="TCP" />
            <var name="RpcProcedure" default="2" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="statd dot dot" protected="true" />
            <var name="SIGID" default="6188" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="S43" />
            <var name="SigStringInfo" default="statd dot dot (UDP)" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="False" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="PortMapProgram" default="791555631" />
            <var name="Protocol" default="UDP" />
            <var name="RpcProcedure" default="2" />
            <var name="RpcProgram" default="100024" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="statd automount attack" protected="true" />
            <var name="SIGID" default="6189" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="S43" />
            <var name="SigStringInfo" default="statd automount attack (UDP)" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="False" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="PortMapProgram" default="100099" />
            <var name="Protocol" default="UDP" />
            <var name="RpcProcedure" default="2" />
            <var name="RpcProgram" default="100024" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="statd automount attack" protected="true" />
            <var name="SIGID" default="6189" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S43" />
            <var name="SigStringInfo" default="statd automount attack (TCP)" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="False" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="PortMapProgram" default="100099" />
            <var name="Protocol" default="TCP" />
            <var name="RpcProcedure" default="2" />
            <var name="RpcProgram" default="100024" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="statd Buffer Overflow" protected="true" />
            <var name="SIGID" default="6190" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="2.1.1.3" />
            <var name="SigStringInfo" default="statd Buffer Overflow (UDP)" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="False" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="Protocol" default="UDP" />
            <var name="RpcMaxLength" default="800" />
            <var name="RpcProgram" default="100024" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="statd Buffer Overflow" protected="true" />
            <var name="SIGID" default="6190" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="2.1.1.3" />
            <var name="SigStringInfo" default="statd Buffer Overflow (TCP)" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="False" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="Protocol" default="TCP" />
            <var name="RpcMaxLength" default="800" />
            <var name="RpcProgram" default="100024" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="ttdbserverd Buffer Overflow" protected="true" />
            <var name="SIGID" default="6191" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="2.1.1.6" />
            <var name="SigStringInfo" default="ttdbserverd Buffer Overflow (UDP)" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="False" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="Protocol" default="UDP" />
            <var name="RpcMaxLength" default="1024" />
            <var name="RpcProcedure" default="7" />
            <var name="RpcProgram" default="100083" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="ttdbserverd Buffer Overflow" protected="true" />
            <var name="SIGID" default="6191" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="2.1.1.6" />
            <var name="SigStringInfo" default="ttdbserverd Buffer Overflow (TCP)" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="False" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="Protocol" default="TCP" />
            <var name="RpcMaxLength" default="1024" />
            <var name="RpcProcedure" default="7" />
            <var name="RpcProgram" default="100083" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="mountd Buffer Overflow" protected="true" />
            <var name="SIGID" default="6192" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="2.1.1.6" />
            <var name="SigStringInfo" default="mountd Buffer Overflow (UDP)" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="False" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="Protocol" default="UDP" />
            <var name="RpcMaxLength" default="1024" />
            <var name="RpcProgram" default="100005" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="mountd Buffer Overflow" protected="true" />
            <var name="SIGID" default="6192" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="2.1.1.6" />
            <var name="SigStringInfo" default="mountd Buffer Overflow (TCP)" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="False" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="Protocol" default="TCP" />
            <var name="RpcMaxLength" default="1024" />
            <var name="RpcProgram" default="100005" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="cmsd Buffer Overflow" protected="true" />
            <var name="SIGID" default="6193" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="2.2.1.2" />
            <var name="SigStringInfo" default="cmsd Buffer Overflow (UDP)" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="False" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="Protocol" default="UDP" />
            <var name="RpcMaxLength" default="1024" />
            <var name="RpcProcedure" default="6" />
            <var name="RpcProgram" default="100068" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="cmsd Buffer Overflow" protected="true" />
            <var name="SIGID" default="6193" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="2.2.1.2" />
            <var name="SigStringInfo" default="cmsd Buffer Overflow (TCP)" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="False" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="Protocol" default="TCP" />
            <var name="RpcMaxLength" default="1024" />
            <var name="RpcProcedure" default="6" />
            <var name="RpcProgram" default="100068" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="sadmind Buffer Overflow" protected="true" />
            <var name="SIGID" default="6194" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="S163" />
            <var name="SigStringInfo" default="sadmind Buffer Overflow (UDP)" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="False" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="Protocol" default="UDP" />
            <var name="RpcMaxLength" default="860" />
            <var name="RpcProcedure" default="1" />
            <var name="RpcProgram" default="100232" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="sadmind Buffer Overflow" protected="true" />
            <var name="SIGID" default="6194" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S163" />
            <var name="SigStringInfo" default="sadmind Buffer Overflow (TCP)" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="False" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="Protocol" default="TCP" />
            <var name="RpcMaxLength" default="860" />
            <var name="RpcProcedure" default="1" />
            <var name="RpcProgram" default="100232" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="amd Buffer Overflow" protected="true" />
            <var name="SIGID" default="6195" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="2.2.1.4" />
            <var name="SigStringInfo" default="amd Buffer Overflow (UDP)" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="False" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="Protocol" default="UDP" />
            <var name="RpcMaxLength" default="1024" />
            <var name="RpcProcedure" default="7" />
            <var name="RpcProgram" default="300019" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="amd Buffer Overflow" protected="true" />
            <var name="SIGID" default="6195" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="2.2.1.4" />
            <var name="SigStringInfo" default="amd Buffer Overflow (TCP)" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="False" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="Protocol" default="TCP" />
            <var name="RpcMaxLength" default="1024" />
            <var name="RpcProcedure" default="7" />
            <var name="RpcProgram" default="300019" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="snmpXdmid Buffer Overflow" protected="true" />
            <var name="SIGID" default="6196" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="S4" />
            <var name="SigStringInfo" default="snmpXdmid Buffer Overflow (UDP)" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="False" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="Protocol" default="UDP" />
            <var name="RpcMaxLength" default="20000" />
            <var name="RpcProcedure" default="257" />
            <var name="RpcProgram" default="100249" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="snmpXdmid Buffer Overflow" protected="true" />
            <var name="SIGID" default="6196" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S4" />
            <var name="SigStringInfo" default="snmpXdmid Buffer Overflow (TCP)" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="False" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="Protocol" default="TCP" />
            <var name="RpcMaxLength" default="20000" />
            <var name="RpcProcedure" default="257" />
            <var name="RpcProgram" default="100249" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="rpc yppaswdd overflow" protected="true" />
            <var name="SIGID" default="6197" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S9" />
            <var name="SigStringInfo" default="yppaswdd overflow - TCP" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="False" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="Protocol" default="TCP" />
            <var name="RpcMaxLength" default="256" />
            <var name="RpcProcedure" default="1" />
            <var name="RpcProgram" default="100009" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="rpc yppaswdd overflow" protected="true" />
            <var name="SIGID" default="6197" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="S9" />
            <var name="SigStringInfo" default="yppaswdd overflow - UDP" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isPortMapper" default="False" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="Protocol" default="UDP" />
            <var name="RpcMaxLength" default="256" />
            <var name="RpcProcedure" default="1" />
            <var name="RpcProgram" default="100009" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="TooltalkDB overflow" protected="true" />
            <var name="SIGID" default="6276" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="S30" />
            <var name="SigStringInfo" default="TooltalkDB overflow - UDP" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="Protocol" default="UDP" />
            <var name="RpcMaxLength" default="1024" />
            <var name="RpcProcedure" default="103" />
            <var name="RpcProgram" default="100083" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="TooltalkDB overflow" protected="true" />
            <var name="SIGID" default="6276" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S30" />
            <var name="SigStringInfo" default="TooltalkDB overflow - TCP" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="Direction" default="ToService" />
            <var name="isSpoofSrc" default="False" />
            <var name="isSweep" default="False" />
            <var name="Protocol" default="TCP" />
            <var name="RpcMaxLength" default="1024" />
            <var name="RpcProcedure" default="103" />
            <var name="RpcProgram" default="100083" />
            <var name="ServicePorts" protected="true" default="111,550-65535" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
        </array>
      </struct>
    </item>
    <item type="SERVICE.DNS">
      <struct name="SERVICE.DNS">
        <var name="version" protected="true">4.0</var>
        <array name="signatures">
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="DNS HINFO" protected="true" />
            <var name="SIGID" default="6050" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1" />
            <var name="SigStringInfo" default="DNS HINFO (UDP)" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="UDP" />
            <var name="QueryType" default="13" />
            <var name="QueryValue" default="False" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="DNS HINFO" protected="true" />
            <var name="SIGID" default="6050" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1" />
            <var name="SigStringInfo" default="DNS HINFO (TCP)" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="TCP" />
            <var name="QueryType" default="13" />
            <var name="QueryValue" default="False" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="DNS Zone Xfer" protected="true" />
            <var name="SIGID" default="6051" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="informational" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1" />
            <var name="SigStringInfo" default="DNS Zone Xfer-UDP" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="UDP" />
            <var name="QuerySrcPort53" default="True" />
            <var name="QueryType" default="252" />
            <var name="QueryValue" default="False" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="DNS Zone Xfer" protected="true" />
            <var name="SIGID" default="6051" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="informational" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1" />
            <var name="SigStringInfo" default="DNS Zone Xfer-TCP" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="TCP" />
            <var name="QuerySrcPort53" default="True" />
            <var name="QueryType" default="252" />
            <var name="QueryValue" default="False" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="DNS High Zone Xfer" protected="true" />
            <var name="SIGID" default="6052" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1" />
            <var name="SigStringInfo" default="DNS High Zone Xfer-UDP" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="UDP" />
            <var name="QuerySrcPort53" default="False" />
            <var name="QueryType" default="252" />
            <var name="QueryValue" default="False" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="DNS High Zone Xfer" protected="true" />
            <var name="SIGID" default="6052" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1" />
            <var name="SigStringInfo" default="DNS High Zone Xfer-TCP" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="TCP" />
            <var name="QuerySrcPort53" default="False" />
            <var name="QueryType" default="252" />
            <var name="QueryValue" default="False" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="DNS Version Request" protected="true" />
            <var name="SIGID" default="6054" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default="DNS Version Request-UDP" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="UDP" />
            <var name="QueryChaosString" default="Version.Bind" />
            <var name="QueryClass" default="3" />
            <var name="QueryType" default="16" />
            <var name="QueryValue" default="False" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="DNS Version Request" protected="true" />
            <var name="SIGID" default="6054" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default="DNS Version Request-TCP" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="TCP" />
            <var name="QueryChaosString" default="Version.Bind" />
            <var name="QueryClass" default="3" />
            <var name="QueryType" default="16" />
            <var name="QueryValue" default="False" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="DNS IQUERY Overflow" protected="true" />
            <var name="SIGID" default="6055" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="DNS IQUERY Overflow-UDP" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="UDP" />
            <var name="QueryOpcode" default="1" />
            <var name="QueryRecordDataLen" default="255" />
            <var name="QueryValue" default="False" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="DNS IQUERY Overflow" protected="true" />
            <var name="SIGID" default="6055" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="DNS IQUERY Overflow-TCP" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="TCP" />
            <var name="QueryOpcode" default="1" />
            <var name="QueryRecordDataLen" default="255" />
            <var name="QueryValue" default="False" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="DNS IQUERY Overflow" protected="true" />
            <var name="SIGID" default="6055" protected="true" />
            <var name="SubSig" default="2" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="DNS IQUERY Overflow-TCP" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="TCP" />
            <var name="QueryOpcode" default="1" />
            <var name="QueryStreamLen" default="2000" />
            <var name="QueryValue" default="False" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="DNS NXT OVerflow" protected="true" />
            <var name="SIGID" default="6056" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="2.2.1.4" />
            <var name="SigStringInfo" default="DNS NXT OVerflow-UDP" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="UDP" />
            <var name="QueryOpcode" default="0" />
            <var name="QueryRecordDataLen" default="2069" />
            <var name="QueryType" default="30" />
            <var name="QueryValue" default="True" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="DNS NXT OVerflow" protected="true" />
            <var name="SIGID" default="6056" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="2.2.1.4" />
            <var name="SigStringInfo" default="DNS NXT OVerflow-TCP" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="TCP" />
            <var name="QueryOpcode" default="0" />
            <var name="QueryRecordDataLen" default="2069" />
            <var name="QueryType" default="30" />
            <var name="QueryValue" default="True" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="DNS NXT OVerflow" protected="true" />
            <var name="SIGID" default="6056" protected="true" />
            <var name="SubSig" default="2" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="2.2.1.4" />
            <var name="SigStringInfo" default="DNS NXT OVerflow-TCP" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="TCP" />
            <var name="QueryOpcode" default="0" />
            <var name="QueryStreamLen" default="3000" />
            <var name="QueryType" default="30" />
            <var name="QueryValue" default="True" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="DNS SIG Overflow" protected="true" />
            <var name="SIGID" default="6057" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="2.2.1.4" />
            <var name="SigStringInfo" default="DNS SIG Overflow-UDP" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="UDP" />
            <var name="QueryOpcode" default="0" />
            <var name="QueryRecordDataLen" default="2069" />
            <var name="QueryType" default="24" />
            <var name="QueryValue" default="True" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="DNS SIG Overflow" protected="true" />
            <var name="SIGID" default="6057" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="2.2.1.4" />
            <var name="SigStringInfo" default="DNS SIG Overflow-TCP" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="TCP" />
            <var name="QueryOpcode" default="0" />
            <var name="QueryRecordDataLen" default="2069" />
            <var name="QueryType" default="24" />
            <var name="QueryValue" default="True" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="DNS SIG Overflow" protected="true" />
            <var name="SIGID" default="6057" protected="true" />
            <var name="SubSig" default="2" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="2.2.1.4" />
            <var name="SigStringInfo" default="DNS SIG Overflow-TCP" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="TCP" />
            <var name="QueryOpcode" default="0" />
            <var name="QueryStreamLen" default="3000" />
            <var name="QueryType" default="24" />
            <var name="QueryValue" default="True" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="DNS SRV DoS" protected="true" />
            <var name="SIGID" default="6058" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="S3" />
            <var name="SigStringInfo" default="DNS SRV DoS-UDP" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="UDP" />
            <var name="QueryClass" default="1" />
            <var name="QueryJumpCountExceeded" default="True" />
            <var name="QueryType" default="33" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="DNS SRV DoS" protected="true" />
            <var name="SIGID" default="6058" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S3" />
            <var name="SigStringInfo" default="DNS SRV DoS-TCP" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="TCP" />
            <var name="QueryClass" default="1" />
            <var name="QueryJumpCountExceeded" default="True" />
            <var name="QueryType" default="33" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="DNS TSIG Overflow" protected="true" />
            <var name="SIGID" default="6059" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="S3" />
            <var name="SigStringInfo" default="DNS TSIG Overflow-UDP" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="UDP" />
            <var name="QueryInvalidDomainName" default="True" />
            <var name="QueryType" default="250" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="DNS TSIG Overflow" protected="true" />
            <var name="SIGID" default="6059" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="S3" />
            <var name="SigStringInfo" default="DNS TSIG Overflow-UDP" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="UDP" />
            <var name="QueryStreamLen" default="500" />
            <var name="QueryType" default="250" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="DNS TSIG Overflow" protected="true" />
            <var name="SIGID" default="6059" protected="true" />
            <var name="SubSig" default="2" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S3" />
            <var name="SigStringInfo" default="DNS TSIG Overflow-TCP" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="TCP" />
            <var name="QueryInvalidDomainName" default="True" />
            <var name="QueryType" default="250" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="DNS Complain Overflow" protected="true" />
            <var name="SIGID" default="6060" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="S3" />
            <var name="SigStringInfo" default="DNS Complain Overflow-UDP" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="UDP" />
            <var name="QueryInvalidDomainName" default="True" />
            <var name="QueryType" default="2" />
            <var name="QueryValue" default="True" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="DNS Complain Overflow" protected="true" />
            <var name="SIGID" default="6060" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="S3" />
            <var name="SigStringInfo" default="DNS Complain Overflow-UDP" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="UDP" />
            <var name="QueryInvalidDomainName" default="True" />
            <var name="QueryOpcode" default="0" />
            <var name="QueryRecordDataInvalid" default="True" />
            <var name="QueryType" default="1" />
            <var name="QueryValue" default="True" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="DNS Complain Overflow" protected="true" />
            <var name="SIGID" default="6060" protected="true" />
            <var name="SubSig" default="2" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S3" />
            <var name="SigStringInfo" default="DNS Complain Overflow-TCP" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="TCP" />
            <var name="QueryInvalidDomainName" default="True" />
            <var name="QueryType" default="2" />
            <var name="QueryValue" default="True" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="DNS Complain Overflow" protected="true" />
            <var name="SIGID" default="6060" protected="true" />
            <var name="SubSig" default="3" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S3" />
            <var name="SigStringInfo" default="DNS Complain Overflow-TCP" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="TCP" />
            <var name="QueryInvalidDomainName" default="True" />
            <var name="QueryOpcode" default="0" />
            <var name="QueryRecordDataInvalid" default="True" />
            <var name="QueryType" default="1" />
            <var name="QueryValue" default="True" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="DNS Infoleak" protected="true" />
            <var name="SIGID" default="6061" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S3" />
            <var name="SigStringInfo" default="DNS Infoleak-UDP" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="UDP" />
            <var name="QueryOpcode" default="1" />
            <var name="QueryRecordDataInvalid" default="True" />
            <var name="QueryValue" default="False" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="DNS Infoleak" protected="true" />
            <var name="SIGID" default="6061" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S3" />
            <var name="SigStringInfo" default="DNS Infoleak-TCP" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="TCP" />
            <var name="QueryOpcode" default="1" />
            <var name="QueryRecordDataInvalid" default="True" />
            <var name="QueryValue" default="False" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="DNS Authors Request" protected="true" />
            <var name="SIGID" default="6062" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S3" />
            <var name="SigStringInfo" default="DNS Authors Request-UDP" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="UDP" />
            <var name="QueryChaosString" default="Authors.Bind" />
            <var name="QueryClass" default="3" />
            <var name="QueryType" default="16" />
            <var name="QueryValue" default="False" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="DNS Authors Request" protected="true" />
            <var name="SIGID" default="6062" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S3" />
            <var name="SigStringInfo" default="DNS Authors Request-TCP" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="TCP" />
            <var name="QueryChaosString" default="Authors.Bind" />
            <var name="QueryClass" default="3" />
            <var name="QueryType" default="16" />
            <var name="QueryValue" default="False" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="BIND Large OPT Record DoS" protected="true" />
            <var name="SIGID" default="6064" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S38" />
            <var name="SigStringInfo" default="Large OPT (UDP)" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="UDP" />
            <var name="QueryRecordDataLen" default="32767" />
            <var name="QueryType" default="41" />
            <var name="StorageKey" default="AaBb" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="30" />
          </entry>
        </array>
      </struct>
    </item>
    <item type="SERVICE.HTTP">
      <struct name="SERVICE.HTTP">
        <var name="version" protected="true">4.0</var>
        <array name="signatures">
          <entry dontDelete="true" nda="false" sfr="76">
            <var name="SigName" default="Bagle Virus Activity" protected="true" />
            <var name="SIGID" default="3140" protected="true" />
            <var name="SubSig" default="3" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S80" />
            <var name="SigStringInfo" default="Bagle.Q HTTP propagation (jpeg)" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="81" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][a-zA-Z][a-zA-Z][a-zA-Z][a-zA-Z][a-zA-Z][a-zA-Z][a-zA-Z][.]jpeg" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="72">
            <var name="SigName" default="Bagle Virus Activity" protected="true" />
            <var name="SIGID" default="3140" protected="true" />
            <var name="SubSig" default="4" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S80" />
            <var name="SigStringInfo" default="Bagle.Q HTTP propagation (php)" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="81" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][0-9][0-9][0-9][0-9][0-9][0-9][.]php" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW phf" protected="true" />
            <var name="SIGID" default="3200" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1" />
            <var name="SigStringInfo" default="phf" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="phf[? \r\n\t]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="76">
            <var name="SigName" default="WWW .url file" protected="true" />
            <var name="SIGID" default="3202" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1" />
            <var name="SigStringInfo" default="Request for .url file" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[.][Uu][Rr][Ll][ \t\n\r]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="76">
            <var name="SigName" default="WWW .lnk file" protected="true" />
            <var name="SIGID" default="3203" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1" />
            <var name="SigStringInfo" default="Request for .lnk file" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[.][Ll][Nn][Kk][ \t\n\r]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="76">
            <var name="SigName" default="WWW .bat file" protected="true" />
            <var name="SIGID" default="3204" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1" />
            <var name="SigStringInfo" default="Request for .bat file" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[.][Bb][Aa][Tt][ \t\n\r]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW campas attack" protected="true" />
            <var name="SIGID" default="3208" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1" />
            <var name="SigStringInfo" default="/campas?" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Cc][Aa][Mm][Pp][Aa][Ss][? \r\n\t]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW glimpse server attack" protected="true" />
            <var name="SIGID" default="3209" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1" />
            <var name="SigStringInfo" default="glimpse | IFS=" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[|]" />
            <var name="ArgValueRegex" protected="true" default="IFS" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="aglimpse" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="IIS DOT DOT EXECUTE Attack" protected="true" />
            <var name="SIGID" default="3215" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1" />
            <var name="SigStringInfo" default="URL with /.." />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\](([Ss][Cc][Rr][Ii][Pp][Tt][Ss])|([Mm][Ss][Aa][Dd][Cc])|(_[Vv][Tt][Ii]_[Bb][Ii][Nn])|(_[Mm][Ee][Mm]_[Bb][Ii][Nn]))[/\\][.][.]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="80">
            <var name="SigName" default="WWW Directory Traversal ../.." protected="true" />
            <var name="SIGID" default="3216" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1" />
            <var name="SigStringInfo" default="../.." />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[.][.][/\\][.][.]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="WWW php view file Bug" protected="true" />
            <var name="SIGID" default="3217" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1" />
            <var name="SigStringInfo" default="php?" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="php[.]cgi" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW SGI wrap bug" protected="true" />
            <var name="SIGID" default="3218" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1" />
            <var name="SigStringInfo" default="wrap?/../" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[/][.][.][/]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="wrap" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="80">
            <var name="SigName" default="WWW php buffer overflow" protected="true" />
            <var name="SIGID" default="3219" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MaxArgFieldLength" default="128" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/]php[.]cgi[?]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="76">
            <var name="SigName" default="WWW View Source GGI Bug" protected="true" />
            <var name="SIGID" default="3221" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1.3" />
            <var name="SigStringInfo" default="view-source?../" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[.][.][/\\]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="view-source" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="76">
            <var name="SigName" default="WWW MLOG/MYLOG CGI Bug" protected="true" />
            <var name="SIGID" default="3222" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1.3" />
            <var name="SigStringInfo" default="mlog/mylog?screen=" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="screen=" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="m[y]?log[.]html" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="76">
            <var name="SigName" default="WWW Webgais Bug" protected="true" />
            <var name="SIGID" default="3224" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1.3" />
            <var name="SigStringInfo" default="query=[']" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="query=[']" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[Ww][Ee][Bb][Gg][Aa][Ii][Ss]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="76">
            <var name="SigName" default="WWW Webdist Bug" protected="true" />
            <var name="SIGID" default="3226" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1.3" />
            <var name="SigStringInfo" default="webdist.cgi" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Ww][Ee][Bb][Dd][Ii][Ss][Tt][.][Cc][Gg][Ii]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="76">
            <var name="SigName" default="WWW Htmlscript Bug" protected="true" />
            <var name="SIGID" default="3227" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1.3" />
            <var name="SigStringInfo" default="htmlscript" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[.][.]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="htmlscript" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="76">
            <var name="SigName" default="WWW Perfomer Bug" protected="true" />
            <var name="SIGID" default="3228" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1.3" />
            <var name="SigStringInfo" default="pfdisplay.cgi?" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[/][.][.]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="pfdisp(la|al)y[.]cgi" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WebSite win-c-sample buffer overflow" protected="true" />
            <var name="SIGID" default="3229" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1.6" />
            <var name="SigStringInfo" default="win-c-sample.exe?" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Ww][Ii][Nn]-[Cc]-[Ss][Aa][Mm][Pp][Ll][Ee][.][Ee][Xx][Ee][?]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WebSite uploader" protected="true" />
            <var name="SIGID" default="3230" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1.6" />
            <var name="SigStringInfo" default="uploader.exe" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Uu][Pp][Ll][Oo][Aa][Dd][Ee][Rr][.][Ee][Xx][Ee]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW finger attempt" protected="true" />
            <var name="SIGID" default="3232" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1.6" />
            <var name="SigStringInfo" default="finger.pl?" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[Ff][Ii][Nn][Gg][Ee][Rr][.][Pp][Ll][?]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW count-cgi Overflow" protected="true" />
            <var name="SIGID" default="3233" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1.6" />
            <var name="SigStringInfo" default="Count.cgi?user=" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ArgNameRegex" protected="true" default="[Uu][Ss][Ee][Rr]=" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MaxArgFieldLength" default="256" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/][Cc][Oo][Uu][Nn][Tt][.][Cc][Gg][Ii]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="IE Local Trusted Resource Execution" protected="true" />
            <var name="SIGID" default="3234" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S98" />
            <var name="SigStringInfo" default="Referer: ms-its:c:\" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="HeaderRegex" protected="true" default="[Rr][Ee][Ff][Ee][Rr][Ee][Rr][:][ ][Mm][Ss][-][Ii][Tt][Ss][:][Cc][:][/\\]" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="IE Local Trusted Resource Execution" protected="true" />
            <var name="SIGID" default="3234" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S98" />
            <var name="SigStringInfo" default="Referer: mk:@MSITStore:c:\" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="HeaderRegex" protected="true" default="[Rr][Ee][Ff][Ee][Rr][Ee][Rr][:][ ][Mm][Kk][:][@][Mm][Ss][Ii][Tt][Ss][Tt][Oo][Rr][Ee][:][cC][:]\\" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="67">
            <var name="SigName" default="XML-RPC PHP Command Execution" protected="true"></var>
            <var name="SIGID" default="3254" protected="true"></var>
            <var name="SubSig" default="0" protected="true"></var>
            <var name="AlarmSeverity" default="high"></var>
            <var name="Enabled" default="True"></var>
            <var name="EventAction" default="alarm"></var>
            <var name="SigVersion" default="S183"></var>
            <var name="SigStringInfo" default="XML-RPC PHP Command Execution"></var>
            <var name="AlarmThrottle" default="Summarize"></var>
            <var name="DeObfuscate" protected="true" default="True"></var>
            <var name="HeaderRegex" protected="true" default="[Cc][Oo][Nn][Tt][Ee][Nn][Tt][-][Tt][Yy][Pp][Ee][:]\x20?([Aa][Pp][Pp][Ll][Ii][Cc][Aa][Tt][Ii][Oo][Nn]|[Tt][Ee][Xx][Tt])[/\\][Xx][Mm][Ll]"></var>
            <var name="MinHits" default="1"></var>
            <var name="Protocol" default="TCP"></var>
            <var name="RequestRegex" protected="true" default="[^\x5c]['][);\x0a\x0d\x20]+([Ee][Cc][Hh][Oo]|[Ss][Yy][Ss][Tt][Ee][Mm])"></var>
            <var name="ServicePorts" default="#WEBPORTS"></var>
            <var name="StorageKey" default="STREAM"></var>
            <var name="SummaryKey" default="AaBb"></var>
            <var name="ThrottleInterval" default="15"></var>
          </entry>
          <entry dontDelete="true" nda="false" sfr="67">
            <var name="SigName" default="XML-RPC PHP Command Execution" protected="true"></var>
            <var name="SIGID" default="3254" protected="true"></var>
            <var name="SubSig" default="1" protected="true"></var>
            <var name="AlarmSeverity" default="high"></var>
            <var name="Enabled" default="True"></var>
            <var name="EventAction" default="alarm"></var>
            <var name="SigVersion" default="S180"></var>
            <var name="SigStringInfo" default="XML-RPC PHP Command Execution"></var>
            <var name="AlarmThrottle" default="Summarize"></var>
            <var name="DeObfuscate" protected="true" default="True"></var>
            <var name="HeaderRegex" protected="true" default="[Cc][Oo][Nn][Tt][Ee][Nn][Tt][-][Tt][Yy][Pp][Ee][:]\x20?([Aa][Pp][Pp][Ll][Ii][Cc][Aa][Tt][Ii][Oo][Nn]|[Tt][Ee][Xx][Tt])[/\\][Xx][Mm][Ll]"></var>
            <var name="MinHits" default="1"></var>
            <var name="Protocol" default="TCP"></var>
            <var name="RequestRegex" protected="true" default="[\x3c][Pp][Aa][Rr][Aa][Mm][>][\x3c][Vv][Aa][Ll][Uu][Ee][>][\x3c][Ss][Tt][Rr][Ii][Nn][Gg][>][A-Za-z0-9]+['][\x20\t][Aa][Nn][Dd][\x20\t][Aa][Ss][Cc][Ii][Ii][(][Ss][Uu][Bb][Ss][Tt][Rr][Ii][Nn][Gg][(]"></var>
            <var name="ServicePorts" default="#WEBPORTS"></var>
            <var name="StorageKey" default="STREAM"></var>
            <var name="SummaryKey" default="AaBb"></var>
            <var name="ThrottleInterval" default="15"></var>
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW IIS newdsn attack" protected="true" />
            <var name="SIGID" default="5034" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="newdsn.exe" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Nn][Ee][Ww][Dd][Ss][Nn][.][Ee][Xx][Ee]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW Windows Password File Access Attempt" protected="true" />
            <var name="SIGID" default="5036" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="/sam._" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/][Ss][Aa][Mm][.]_[ \t\n\r]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW Windows Password File Access Attempt" protected="true" />
            <var name="SIGID" default="5036" protected="true" />
            <var name="SubSig" default="2" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="/config/sam" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/][Cc][Oo][Nn][Ff][Ii][Gg][/][Ss][Aa][Mm][ \t\n\r]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW MachineInfo attempt" protected="true" />
            <var name="SIGID" default="5037" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="/cgi-bin/MachineInfo" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/][Mm]achine[Ii]nfo" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="WWW wwwsql file read Bug" protected="true" />
            <var name="SIGID" default="5038" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="/cgi-bin/www-sql/cgi-bin/www-sql" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/]cgi-bin[/]www-sql[/]cgi-bin[/]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="WWW finger attempt" protected="true" />
            <var name="SIGID" default="5039" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="/cgi-bin/finger?" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/]finger[?]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW anyform attack" protected="true" />
            <var name="SIGID" default="5041" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="anyform.cgi*;/" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[;][/]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[Aa][Nn][Yy][Ff][Oo][Rr][Mm]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="WWW valid shell access attempt" protected="true" />
            <var name="SIGID" default="5042" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="/cgi-bin/bash" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Cc][Gg][Ii]-[Bb][Ii][Nn][/\\]bash[? \n\r\t]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="WWW valid shell access attempt" protected="true" />
            <var name="SIGID" default="5042" protected="true" />
            <var name="SubSig" default="2" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="/cgi-bin/tcsh" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Cc][Gg][Ii]-[Bb][Ii][Nn][/\\]tcsh[? \n\r\t]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="WWW valid shell access attempt" protected="true" />
            <var name="SIGID" default="5042" protected="true" />
            <var name="SubSig" default="3" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="/cgi-bin/*sh" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Cc][Gg][Ii]-[Bb][Ii][Nn][/\\][abcjkz]sh[? \n\r\t]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="WWW valid shell access attempt" protected="true" />
            <var name="SIGID" default="5042" protected="true" />
            <var name="SubSig" default="4" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="/cgi-bin/sh" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Cc][Gg][Ii]-[Bb][Ii][Nn][/\\]sh[? \t\n\r]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="WWW valid shell access attempt" protected="true" />
            <var name="SIGID" default="5042" protected="true" />
            <var name="SubSig" default="5" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="/cgi-bin/java" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Cc][Gg][Ii]-[Bb][Ii][Nn][/\\][Jj][Aa][Vv][Aa][? \t\n\r]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="WWW valid shell access attempt" protected="true" />
            <var name="SIGID" default="5042" protected="true" />
            <var name="SubSig" default="6" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="/cgi-bin/python" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Cc][Gg][Ii]-[Bb][Ii][Nn][/\\][Pp][Yy][Tt][Hh][Oo][Nn][? \t\n\r]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW Cold Fusion Attack" protected="true" />
            <var name="SIGID" default="5043" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="/cfdocs/expeval/openfile.cfm" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Cc][Ff][Dd][Oo][Cc][Ss][/][Ee][Xx][Pp][Ee][Vv][Aa][Ll][/\\][Oo][Pp][Ee][Nn][Ff][Ii][Ll][Ee][.][Cc][Ff][Mm]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW Cold Fusion Attack" protected="true" />
            <var name="SIGID" default="5043" protected="true" />
            <var name="SubSig" default="2" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="/cfdocs/expeval/displayopenedfile.cfm" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Cc][Ff][Dd][Oo][Cc][Ss][/\\][Ee][Xx][Pp][Ee][Vv][Aa][Ll][/\\][Dd][Ii][Ss][Pp][Ll][Aa][Yy][Oo][Pp][Ee][Nn][Ee][Dd][Ff][Ii][Ll][Ee][.][Cc][Ff][Mm]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW Cold Fusion Attack" protected="true" />
            <var name="SIGID" default="5043" protected="true" />
            <var name="SubSig" default="3" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="/cfdocs/expeval/exprcalc.cfm" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Cc][Ff][Dd][Oo][Cc][Ss][/\\][Ee][Xx][Pp][Ee][Vv][Aa][Ll][/\\][Ee][Xx][Pp][Rr][Cc][Aa][Ll][Cc][.][Cc][Ff][Mm]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW Webcom.se Guestbook attack" protected="true" />
            <var name="SIGID" default="5044" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="/cgi-bin/[wr]guest.exe?template=3D.*:" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="template=3D" />
            <var name="ArgValueRegex" protected="true" default="[:][\\]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/][WwRr][Gg][Uu][Ee][Ss][Tt][.][Ee][Xx][Ee]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="WWW dumpenv.pl recon" protected="true" />
            <var name="SIGID" default="5046" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="dumpenv.pl" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[Dd][Uu][Mm][Pp][Ee][Nn][Vv][.][Pp][Ll]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="WWW Server Side Include POST attack" protected="true" />
            <var name="SIGID" default="5047" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="\x26lt;!-- #exec cmd=" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[\x3c][!][-][-]" />
            <var name="ArgValueRegex" protected="true" default="[#][Ee][Xx][Ee][Cc].*[Cc][Mm][Dd]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW IIS BAT EXE attack" protected="true" />
            <var name="SIGID" default="5048" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default=".bat?\x26amp;dir+*:\\\\+?\x26amp;" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[\x26]+.*[?][\x26]+" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[.][Bb][Aa][Tt]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="76">
            <var name="SigName" default="WWW IIS showcode.asp access" protected="true" />
            <var name="SIGID" default="5049" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="showcode.asp" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Ss][Ee][Ll][Ee][Cc][Tt][Oo][Rr][/\\][Ss][Hh][Oo][Ww][Cc][Oo][Dd][Ee][.][Aa][Ss][Pp]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW IIS .htr Overflow" protected="true" />
            <var name="SIGID" default="5050" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="IIS .htr Overflow" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MaxUriFieldLength" default="256" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[.][Hh][Tt][Rr][ \t]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW IIS double-byte attack" protected="true" />
            <var name="SIGID" default="5051" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.2" />
            <var name="SigStringInfo" default="*.asp%[0x81-0xfe]" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="False" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[.][Aa][Ss][Pp][%][8][123456789ABCDEFabcdef][ \r\n\t]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW IIS double-byte attack" protected="true" />
            <var name="SIGID" default="5051" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.2" />
            <var name="SigStringInfo" default="*.asp%[0x81-0xfe]" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="False" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[.][Aa][Ss][Pp][%][9ABCDEabcde][0123456789ABCDEFabcdef][ \r\n\t]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW IIS double-byte attack" protected="true" />
            <var name="SIGID" default="5051" protected="true" />
            <var name="SubSig" default="2" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.2" />
            <var name="SigStringInfo" default="*.asp%[0x81-0xfe]" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="False" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[.][Aa][Ss][Pp][%][Ff][0123456789ABCDEabcde][ \r\n\t]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW VTI Open attempt" protected="true" />
            <var name="SIGID" default="5052" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.2" />
            <var name="SigStringInfo" default="vti_pvt/*.pwd" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RequestRegex" protected="true" default="[.][Pp][Ww][Dd]" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][_][Vv][Tt][Ii][_][Pp][Vv][Tt][/\\]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW VTI bin list attempt" protected="true" />
            <var name="SIGID" default="5053" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.2" />
            <var name="SigStringInfo" default="vti_bin/" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][_][Vv][Tt][Ii][_][Bb][Ii][Nn][/\\][ \t\r\n]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="WWW WWWBoard attack" protected="true" />
            <var name="SIGID" default="5054" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.2" />
            <var name="SigStringInfo" default="wwwboard.pl" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Ww][Ww][Ww][Bb][Oo][Aa][Rr][Dd][.][Pp][Ll][? \r\n\t]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="WWW Basic Auth Overflow" protected="true" />
            <var name="SIGID" default="5055" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="2.2.1.3" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="DeObfuscate" protected="true" default="False" />
            <var name="MinHits" default="1" />
            <var name="MinRequestMatchLength" default="128" />
            <var name="Protocol" default="TCP" />
            <var name="RequestRegex" protected="true" default="Authorization:[ ]Basic[ ][A-Za-z0-9/=+]+[ \t\r\n]" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW info2www attack" protected="true" />
            <var name="SIGID" default="5058" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default="/info2www*|" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[|]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Ii][Nn][Ff][Oo]2[Ww][Ww][Ww]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW Alibaba attack" protected="true" />
            <var name="SIGID" default="5059" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default="/get32.exe*|" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[|]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Gg][Ee][Tt]32[.][Ee][Xx][Ee]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW Alibaba attack" protected="true" />
            <var name="SIGID" default="5059" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default="/alibaba.pl*|" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[|]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Aa][Ll][Ii][Bb][Aa][Bb][Aa][.][Pp][Ll]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW Alibaba attack" protected="true" />
            <var name="SIGID" default="5059" protected="true" />
            <var name="SubSig" default="2" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S127" />
            <var name="SigStringInfo" default="/tst.bat*|" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[|]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Tt][Ss][Tt][.][Bb][Aa][Tt]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW Excite AT-generate.cgi access" protected="true" />
            <var name="SIGID" default="5060" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default="/AT-Generate.cgi" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Aa][Tt][-][Gg][Ee][Nn][Ee][Rr][Aa][Tt][Ee][.][Cc][Gg][Ii]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW catalog_type.asp access" protected="true" />
            <var name="SIGID" default="5061" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default="/equipment/catalog_type.asp" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Ee][Qq][Uu][Ii][Pp][Mm][Ee][Nn][Tt][/\\][Cc][Aa][Tt][Aa][Ll][Oo][Gg]_[Tt][Yy][Pp][Ee][.][Aa][Ss][Pp]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW dbmlparser.exe access" protected="true" />
            <var name="SIGID" default="5063" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default="/dbmlparser.exe" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Dd][Bb][Mm][Ll][Pp][Aa][Rr][Ss][Ee][Rr][.][Ee][Xx][Ee]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW imagemap.cgi attack" protected="true" />
            <var name="SIGID" default="5064" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default="imagemap.cgi?" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="\x90" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[Ii][Mm][Aa][Gg][Ee][Mm][Aa][Pp][.][Ee][Xx][Ee]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW IRIX infosrch.cgi attack" protected="true" />
            <var name="SIGID" default="5065" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default="infosrch.cgi?" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[|]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="infosrch.cgi" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW man.sh access" protected="true" />
            <var name="SIGID" default="5066" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default="/man.sh" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="/man[.]sh[? \t]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW formmail.pl access" protected="true" />
            <var name="SIGID" default="5068" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default="/formmail.pl?" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Ff][Oo][Rr][Mm][Mm][Aa][Ii][Ll][.][Pp][Ll][?]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW whois_raw.cgi attack" protected="true" />
            <var name="SIGID" default="5069" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default="/whois_raw.cgi?" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="fqdn" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[Ww][Hh][Oo][Ii][Ss]_[Rr][Aa][Ww][.][Cc][Gg][Ii]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW msadcs.dll access" protected="true" />
            <var name="SIGID" default="5070" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default="msadc/msadcs.dll" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[Mm][Ss][Aa][Dd][Cc][/\\][Mm][Ss][Aa][Dd][Cc][Ss][.][Dd][Ll][Ll][ \t]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW msadcs.dll attack" protected="true" />
            <var name="SIGID" default="5071" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default="msadc/msadcs.dll/*|shell" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[|]\x00[Ss]\x00[Hh]\x00[Ee]\x00[Ll]\x00[Ll]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[Mm][Ss][Aa][Dd][Cc][/\\][Mm][Ss][Aa][Dd][Cc][Ss][.][Dd][Ll][Ll][/\\]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW bizdb1-search.cgi attack" protected="true" />
            <var name="SIGID" default="5072" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default="bizdb1-search.cgi*|" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[|]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[Bb][Ii][Zz][Dd][Bb]1[-][Ss][Ee][Aa][Rr][Cc][Hh][.][Cc][Gg][Ii]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW EZShopper loadpage.cgi attack" protected="true" />
            <var name="SIGID" default="5073" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default="loadpage.cgi*|" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[|]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[Ll][Oo][Aa][Dd][Pp][Aa][Gg][Ee][.][Cc][Gg][Ii]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW EZShopper search.cgi attack" protected="true" />
            <var name="SIGID" default="5074" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default="search.cgi*|" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[|]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Ss][Ee][Aa][Rr][Cc][Hh][.][Cc][Gg][Ii]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW IIS Virtualized UNC Bug" protected="true" />
            <var name="SIGID" default="5075" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default=".asp\\\\" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[.][Aa][Ss][Pp][\\][ \t]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW webplus bug" protected="true" />
            <var name="SIGID" default="5076" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default="webplus?*/../.." />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[/\\][.][.][/\\][.][.]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[Ww][Ee][Bb][Pp][Ll][Uu][Ss]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW Piranha passwd attack" protected="true" />
            <var name="SIGID" default="5078" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.5" />
            <var name="SigStringInfo" default="/secure/passwd.php3?*/" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[/]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/]secure[/]passwd.php3[?]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW PCCS MySQL admin access" protected="true" />
            <var name="SIGID" default="5079" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.6" />
            <var name="SigStringInfo" default="/pccsmysqladm/incs/dbconnect.inc" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/]pccsmysqladm[/]incs[/]dbconnect[.]inc" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW IBM WebSphere access" protected="true" />
            <var name="SIGID" default="5080" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.6" />
            <var name="SigStringInfo" default="/servlet/file/*jsp" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RequestRegex" protected="true" default="[Jj][Ss][Pp]" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Ss][Ee][Rr][Vv][Ll][Ee][Tt][/\\][Ff][Ii][Ll][Ee]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW WinNT cmd.exe access" protected="true" />
            <var name="SIGID" default="5081" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S109" />
            <var name="SigStringInfo" default="/system32/cmd.exe" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Ss][Yy][Ss][Tt][Ee][Mm][3][2][/\\][Cc][Mm][Dd][.][Ee][Xx][Ee]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW Alibaba attack 2" protected="true" />
            <var name="SIGID" default="5084" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.6" />
            <var name="SigStringInfo" default="/post32.exe|" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Pp][Oo][Ss][Tt][3][2][.][Ee][Xx][Ee][|]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW Alibaba attack 2" protected="true" />
            <var name="SIGID" default="5084" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.6" />
            <var name="SigStringInfo" default="/lsindex2.bat|" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Ll][Ss][Ii][Nn][Dd][Ee][Xx][2][.][Bb][Aa][Tt][|]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW IIS Source Fragment access" protected="true" />
            <var name="SIGID" default="5085" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.6" />
            <var name="SigStringInfo" default="/someasp.asp+.htr" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[+][.][Hh][Tt][Rr]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW Akopia MiniVend access" protected="true" />
            <var name="SIGID" default="5088" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.6" />
            <var name="SigStringInfo" default="/view_page.html" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Vv][Ii][Ee][Ww][_][Pp][Aa][Gg][Ee][.][Hh][Tt][Mm][Ll]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW Cart32 Remote Admin access" protected="true" />
            <var name="SIGID" default="5091" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.6" />
            <var name="SigStringInfo" default="/cart32.exe/cart32clientlist" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Cc][Aa][Rr][Tt][3][2][.][Ee][Xx][Ee][/\\][Cc][Aa][Rr][Tt][3][2][Cc][Ll][Ii][Ee][Nn][Tt][Ll][Ii][Ss][Tt]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW Cart32 Remote Admin access" protected="true" />
            <var name="SIGID" default="5091" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.6" />
            <var name="SigStringInfo" default="/c32web.exe/changeadminpassword" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Cc][3][2][Ww][Ee][Bb][.][Ee][Xx][Ee][/\\][Cc][Hh][Aa][Nn][Gg][Ee][Aa][Dd][Mm][Ii][Nn][Pp][Aa][Ss][Ss][Ww][Oo][Rr][Dd]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW CGI-World Poll It access" protected="true" />
            <var name="SIGID" default="5092" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.6" />
            <var name="SigStringInfo" default="/Poll_It_SSI_v2.0.cgi?data_dir=*%00" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="data_dir=" />
            <var name="ArgValueRegex" protected="true" default="[%]00" />
            <var name="DeObfuscate" protected="true" default="False" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/]Poll_It_SSI_v2.0.cgi" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW PHP-Nuke admin.php3 access" protected="true" />
            <var name="SIGID" default="5093" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.6" />
            <var name="SigStringInfo" default="/admin.php3?admin=" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="admin=" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/]admin.php3" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW CGI Script Center Account Manager attack" protected="true" />
            <var name="SIGID" default="5095" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.6" />
            <var name="SigStringInfo" default="/amlite/amadmin.pl*setpwd=++Set+Password++" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="setpwd=[+][+]Set[+]Password[+][+]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/]amlite/amadmin[.]pl" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW CGI Script Center Subscribe Me attack" protected="true" />
            <var name="SIGID" default="5096" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.6" />
            <var name="SigStringInfo" default="/subscribe.pl*setpwd=++Set+Password++" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="setpwd=[+][+]Set[+]Password[+][+]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/]subscribe[.]pl" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW GWScripts News Publisher access" protected="true" />
            <var name="SIGID" default="5099" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.6" />
            <var name="SigStringInfo" default="/news/news.cgi?addauthor" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[Aa][Dd][Dd][Aa][Uu][Tt][Hh][Oo][Rr]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Nn][Ee][Ww][Ss][/\\][Nn][Ee][Ww][Ss][.][Cc][Gg][Ii]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW CGI Center Auction Weaver file access" protected="true" />
            <var name="SIGID" default="5100" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.6" />
            <var name="SigStringInfo" default="/awl/auctionweaver.pl*catdir=*..\\\\.." />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[Cc][Aa][Tt][Dd][Ii][Rr][=]" />
            <var name="ArgValueRegex" protected="true" default="[.][.][/\\][.][.]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Aa][Ww][Ll][/\\][Aa][Uu][Cc][Tt][Ii][Oo][Nn][Ww][Ee][Aa][Vv][Ee][Rr][.][Pp][Ll]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW CGI Center Auction Weaver attack" protected="true" />
            <var name="SIGID" default="5101" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.6" />
            <var name="SigStringInfo" default="/awl/auctionweaver.pl*|" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[|]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Aa][Ww][Ll][/\\][Aa][Uu][Cc][Tt][Ii][Oo][Nn][Ww][Ee][Aa][Vv][Ee][Rr][.][Pp][Ll]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW phpPhotoAlbum explorer.php access" protected="true" />
            <var name="SIGID" default="5102" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.6" />
            <var name="SigStringInfo" default="/phpphotoalbum/explorer.php=../.." />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Pp][Hh][Pp][Pp][Hh][Oo][Tt][Oo][Aa][Ll][Bb][Uu][Mm][/\\][Ee][Xx][Pp][Ll][Oo][Rr][Ee][Rr][.][Pp][Hh][Pp][=][.][.][/\\][.][.]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW Mandrake Linux /perl access" protected="true" />
            <var name="SIGID" default="5107" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.6" />
            <var name="SigStringInfo" default="/perl" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/]perl[ \t\r\n]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW Netegrity SiteMinder access" protected="true" />
            <var name="SIGID" default="5108" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.6" />
            <var name="SigStringInfo" default="/$/*ccc" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RequestRegex" protected="true" default="[Cc][Cc][Cc]" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][$][/\\]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW Netegrity SiteMinder access" protected="true" />
            <var name="SIGID" default="5108" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.6" />
            <var name="SigStringInfo" default="/$/*jpg" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RequestRegex" protected="true" default="[Jj][Pp][Gg]" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][$][/\\]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW Netegrity SiteMinder access" protected="true" />
            <var name="SIGID" default="5108" protected="true" />
            <var name="SubSig" default="2" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.6" />
            <var name="SigStringInfo" default="/$/*class" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RequestRegex" protected="true" default="[Cc][Ll][Aa][Ss][Ss]" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][$][/\\]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW IIS Unicode attack" protected="true" />
            <var name="SIGID" default="5114" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="2.2.1.6" />
            <var name="SigStringInfo" default="..%c1%1c..*" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="False" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[.][.][%][Cc][1][%][1][Cc][.][.]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW IIS Unicode attack" protected="true" />
            <var name="SIGID" default="5114" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="2.2.1.6" />
            <var name="SigStringInfo" default="..%c0%af..*HTTP" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="False" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[.][.][%][Cc][0][%][Aa][Ff][.][.]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW IIS Unicode attack" protected="true" />
            <var name="SIGID" default="5114" protected="true" />
            <var name="SubSig" default="2" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="2.2.1.6" />
            <var name="SigStringInfo" default="..%c1%9c..*HTTP" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="False" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[.][.][%][Cc][1][%][9][Cc][.][.]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW Endymion MailMan Cmd Exec" protected="true" />
            <var name="SIGID" default="5116" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S3" />
            <var name="SigStringInfo" default="mmstdod.cgi?" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="ALTERNATE[_]TEMPLATES[=][|]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Mm][Mm][Ss][Tt][Dd][Oo][Dd][.][Cc][Gg][Ii]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="76">
            <var name="SigName" default="WWW PhpGroupware Cmd Exec" protected="true" />
            <var name="SIGID" default="5117" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S3" />
            <var name="SigStringInfo" default="phpgw?phpgw_info.*=http://" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[Pp][Hh][Pp][Gg][Ww][_][Ii][Nn][Ff][Oo]" />
            <var name="ArgValueRegex" protected="true" default="[=][Hh][Tt][Tt][Pp][:][/]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Pp][Hh][Pp][Gg][Ww]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW CGI News Update Admin Pass Change" protected="true" />
            <var name="SIGID" default="5119" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S3" />
            <var name="SigStringInfo" default="/newsup.pl*setpwd" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="setpwd=[+][+]Set[+]Password[+][+]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Nn][Ee][Ww][Ss][Uu][Pp][.][Pp][Ll]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="76">
            <var name="SigName" default="WWW iPlanet .shtml Buffer Overflow" protected="true" />
            <var name="SIGID" default="5121" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S4" />
            <var name="SigStringInfo" default="/\x26lt; 190+ chars&gt; .shtml" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="DeObfuscate" protected="true" default="False" />
            <var name="MinHits" default="1" />
            <var name="MinRequestMatchLength" default="190" />
            <var name="Protocol" default="TCP" />
            <var name="RequestRegex" protected="true" default="[a-zA-Z0-9\-_][/\\][^/\\\x26= \t\r\n:?]+[.][Ss][Hh][Tt][Mm][Ll]" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="76">
            <var name="SigName" default="WWW Nokia IP440 Denial of Service" protected="true" />
            <var name="SIGID" default="5122" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S4" />
            <var name="SigStringInfo" default="?\x26lt;500+ chars&gt;TEMPLATE=main" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ArgNameRegex" protected="true" default="[\x26]TEMPLATE[=][Mm][Aa][Ii][Nn]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MaxArgFieldLength" default="500" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW IIS .ida Indexing Service Overflow" protected="true" />
            <var name="SIGID" default="5126" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S168" />
            <var name="SigStringInfo" default=".id[aq]\x26lt;200+ chars&gt;" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MaxArgFieldLength" default="200" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[.][Ii][Dd][AaQq]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW viewsrc.cgi Directory Traversal" protected="true" />
            <var name="SIGID" default="5127" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S5" />
            <var name="SigStringInfo" default="/viewsrc.cgi*../" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[.][.][/\\]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Vv][Ii][Ee][Ww][Ss][Rr][Cc][.][Cc][Gg][Ii]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW nph-maillist.pl Cmd Exec" protected="true" />
            <var name="SIGID" default="5128" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S5" />
            <var name="SigStringInfo" default="/nph-maillist.pl?*;" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="emailaddress[=]" />
            <var name="ArgValueRegex" protected="true" default="[;]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Nn][Pp][Hh][-][Mm][Aa][Ii][Ll][Ll][Ii][Ss][Tt][.][Pp][Ll]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="Net.Commerce Macro Denial of Service" protected="true" />
            <var name="SIGID" default="5140" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S5" />
            <var name="SigStringInfo" default="(%0A)\x26lt;30+times&gt;" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Mm][Aa][Cc][Rr][Oo][.][Dd]2[Ww][/\\]([%]0A){30}" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="80">
            <var name="SigName" default="NCM Content Mgmt Input Validation" protected="true" />
            <var name="SIGID" default="5141" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S5" />
            <var name="SigStringInfo" default="content.pl?.*\x26lt;&gt;" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[\x3c&gt;]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Cc][Oo][Nn][Tt][Ee][Nn][Tt][.][Pp][Ll]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="DCShop File Disclosure" protected="true" />
            <var name="SIGID" default="5142" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S6" />
            <var name="SigStringInfo" default="/DCShop/Auth_data/auth_user_file.txt" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Dd][Cc][Ss][Hh][Oo][Pp][/\\][Aa][Uu][Tt][Hh][_][Dd][Aa][Tt][Aa][/\\][Aa][Uu][Tt][Hh][_][Uu][Ss][Ee][Rr][_][Ff][Ii][Ll][Ee][.][Tt][Xx][Tt]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="Arcadia Internet Store Directory Traversal Bug" protected="true" />
            <var name="SIGID" default="5147" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S6" />
            <var name="SigStringInfo" default="tradecli.dll.*../.." />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[Tt][Ee][Mm][Pp][Ll][Aa][Tt][Ee][=]" />
            <var name="ArgValueRegex" protected="true" default="[.][.][/\\][.][.]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[Tt][Rr][Aa][Dd][Ee][Cc][Ll][Ii][.][Dd][Ll][Ll]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW uDirectory Directory Traversal" protected="true" />
            <var name="SIGID" default="5154" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S6" />
            <var name="SigStringInfo" default="uDirectory?*../" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[.][.][/\\]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[Uu][Dd][Ii][Rr][Ee][Cc][Tt][Oo][Rr][Yy][.][Pp][Ll]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="WWW SiteWare Editor Directory Traversal" protected="true" />
            <var name="SIGID" default="5155" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S6" />
            <var name="SigStringInfo" default="SWEditServlet?*../" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[.][.][/\\]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[Ss][Ww][Ee][Dd][Ii][Tt][Ss][Ee][Rr][Vv][Ll][Ee][Tt]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="WWW Microsoft fp30reg.dll Overflow" protected="true" />
            <var name="SIGID" default="5156" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S6" />
            <var name="SigStringInfo" default="fp30reg.dll\x26lt;258+ chars&gt;" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MaxArgFieldLength" default="258" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[Ff][Pp]30[Rr][Ee][Gg][.][Dd][Ll][Ll]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="phpMyAdmin Cmd Exec" protected="true" />
            <var name="SIGID" default="5159" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S7" />
            <var name="SigStringInfo" default="goto=\x26amp;btnDrop" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[Gg][Oo][Tt][Oo][=]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RequestRegex" protected="true" default="[Bb][Tt][Nn][Dd][Rr][Oo][Pp]" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[Ss][Qq][Ll][.][Pp][Hh][Pp]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="Apache Authentication Module ByPass" protected="true" />
            <var name="SIGID" default="5184" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S12" />
            <var name="SigStringInfo" default="Authorization:*select" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="False" />
            <var name="HeaderRegex" protected="true" default="^[Aa][Uu][Tt][Hh][Oo][Rr][Ii][Zz][Aa][Tt][Ii][Oo][Nn][:][^\r\n]*[Ss][Ee][Ll][Ee][Cc][Tt]" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="HTTP tunneling" protected="true" />
            <var name="SIGID" default="5188" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S12" />
            <var name="SigStringInfo" default="GET /erc/Poll?machineKey" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="machinekey" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="8200" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\]erc[/\\]Poll" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="HTTP tunneling" protected="true" />
            <var name="SIGID" default="5188" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S12" />
            <var name="SigStringInfo" default="POST http://www.firethru.com/cgi-bin/proxy" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="HeaderRegex" protected="true" default="firethru[.]com" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\]cgi[-]bin[/\\]proxy" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="HTTP tunneling" protected="true" />
            <var name="SIGID" default="5188" protected="true" />
            <var name="SubSig" default="2" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S95" />
            <var name="SigStringInfo" default="Host: photo.exectech-va.com / photo.technetva.com" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="HeaderRegex" protected="true" default="Host[:][ \t]+photo[.](exectech[-]va|technetva)[.]com" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="76">
            <var name="SigName" default="HTTP tunneling" protected="true" />
            <var name="SIGID" default="5188" protected="true" />
            <var name="SubSig" default="3" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S142" />
            <var name="SigStringInfo" default="POST /index.html?crap=" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="crap[=]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\]index[.]html" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="HTTP 1.1 Chunked Encoding Transfer" protected="true" />
            <var name="SIGID" default="5245" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S179" />
            <var name="SigStringInfo" default="Transfer-Encoding: chunked" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="HeaderRegex" protected="true" default="[Tt][Rr][Aa][Nn][Ss][Ff][Ee][Rr]-[Ee][Nn][Cc][Oo][Dd][Ii][Nn][Gg][:][ \t]+[Cc][Hh][Uu][Nn][Kk][Ee][Dd]" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="76">
            <var name="SigName" default="Root.exe access" protected="true" />
            <var name="SIGID" default="5326" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S30" />
            <var name="SigStringInfo" default="root.exe" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Rr][Oo][Oo][Tt][.][Ee][Xx][Ee]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="Apache/mod_ssl Worm Probe" protected="true" />
            <var name="SIGID" default="5329" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="1.0" />
            <var name="SigStringInfo" default="/mod_ssl:error:HTTP-request" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[Mm][Oo][Dd][_][Ss][Ss][Ll][:][Ee][Rr][Rr][Oo][Rr][:][Hh][Tt][Tt][Pp][-][Rr][Ee][Qq][Uu][Ee][Ss][Tt]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="72">
            <var name="SigName" default="IIS WebDAV Overflow" protected="true" />
            <var name="SIGID" default="5364" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S43" />
            <var name="SigStringInfo" default="GET ...\x26lt;65000+ chars&gt;... translate:" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MaxUriFieldLength" default="65000" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="RequestRegex" protected="true" default="[Tt][Rr][Aa][Nn][Ss][Ll][Aa][Tt][Ee][:][ \t]" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="Swen Worm HTTP Counter Update Attempt" protected="true" />
            <var name="SIGID" default="5390" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S54" />
            <var name="SigStringInfo" default="/bin/counter.gif/link=bacillus" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Bb][Ii][Nn][/\\][Cc][Oo][Uu][Nn][Tt][Ee][Rr][.][Gg][Ii][Ff][/\\][Ll][Ii][Nn][Kk][=][Bb][Aa][Cc][Ii][Ll][Ll][Uu][Ss]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="76">
            <var name="SigName" default="Beagle.B (Bagle.B) Web Beacon" protected="true" />
            <var name="SIGID" default="5400" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop|reset" />
            <var name="SigVersion" default="S71" />
            <var name="SigStringInfo" default="1.php?p=8866 / 2.php?p=8866" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="[Pp][=]" />
            <var name="ArgValueRegex" protected="true" default="8866" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="HeaderRegex" protected="true" default="[Uu][Ss][Ee][Rr][-][Aa][Gg][Ee][Nn][Tt][:][ ][Aa][Uu]" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][12][.][Pp][Hh][Pp]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="72">
            <var name="SigName" default="KaZaA Client Activity" protected="true" />
            <var name="SIGID" default="11005" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S107" />
            <var name="SigStringInfo" default="P2P-Agent: Kazaa" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="HeaderRegex" protected="true" default="[Pp]2[Pp][-][Aa][Gg][Ee][Nn][Tt][:][ ][Kk][Aa][Zz][Aa][Aa]" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="AIM / ICQ Through HTTP Proxy" protected="true" />
            <var name="SIGID" default="11210" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="informational" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S139" />
            <var name="SigStringInfo" default="proxy.icq.com" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="HeaderRegex" protected="true" default="[Hh][Oo][Ss][Tt][:][ ][Hh][Tt][Tt][Pp][.][Pp][Rr][Oo][Xx][Yy][.][Ii][Cc][Qq][.][Cc][Oo][Mm]" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="MSN Messenger Through HTTP Proxy" protected="true" />
            <var name="SIGID" default="11211" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="informational" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S139" />
            <var name="SigStringInfo" default="Content-Type: application/x-msn-messenger" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ArgNameRegex" protected="true" default="[Ss][Ee][Ss][Ss][Ii][Oo][Nn][Ii][Dd][=]" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="HeaderRegex" protected="true" default="[Cc][Oo][Nn][Tt][Ee][Nn][Tt][-][Tt][Yy][Pp][Ee][:][ ][Aa][Pp][Pp][Ll][Ii][Cc][Aa][Tt][Ii][Oo][Nn][/\\][Xx][-][Mm][Ss][Nn][-][Mm][Ee][Ss][Ss][Ee][Nn][Gg][Ee][Rr]" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="[/\\][Gg][Aa][Tt][Ee][Ww][Aa][Yy][/\\][Gg][Aa][Tt][Ee][Ww][Aa][Yy][.][Dd][Ll][Ll]" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="Yahoo Messenger Through HTTP Proxy" protected="true" />
            <var name="SIGID" default="11212" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="informational" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S139" />
            <var name="SigStringInfo" default="Host: msg.yahoo.com" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="HeaderRegex" protected="true" default="[Mm][Ss][Gg][.][Yy][Aa][Hh][Oo][Oo][.][Cc][Oo][Mm]" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="Cydoor Spyware" protected="true" />
            <var name="SIGID" default="12004" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S92" />
            <var name="SigStringInfo" default="/script/.../...init.asp/D2=????" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ArgNameRegex" protected="true" default="D2" />
            <var name="ArgValueRegex" protected="true" default="\?\?\?\?" />
            <var name="DeObfuscate" protected="true" default="True" />
            <var name="MinHits" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="ServicePorts" default="#WEBPORTS" />
            <var name="StorageKey" default="STREAM" />
            <var name="SummaryKey" default="AaBb" />
            <var name="ThrottleInterval" default="15" />
            <var name="UriRegex" protected="true" default="/scripts/[a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9]/[a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9]Init.ASP" />
          </entry>
        </array>
      </struct>
    </item>
    <item type="ATOMIC.TCP">
      <struct name="ATOMIC.TCP">
        <var name="version" protected="true">4.0</var>
        <array name="signatures">
          <entry dontDelete="true" nda="false" sfr="95">
            <var name="SigName" default="TCP FRAG NULL Packet" protected="true" />
            <var name="SIGID" default="3038" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Mask" protected="true" default="URG|ACK|PSH|RST|SYN|FIN" />
            <var name="PortRange" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="Axxx" />
            <var name="TcpFlags" protected="true" default="ZERO" />
            <var name="ThrottleInterval" default="30" />
            <var name="WantFrag" default="True" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="95">
            <var name="SigName" default="TCP FRAG FIN Packet" protected="true" />
            <var name="SIGID" default="3039" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Mask" protected="true" default="ACK|SYN|FIN" />
            <var name="PortRange" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="Axxx" />
            <var name="TcpFlags" protected="true" default="FIN" />
            <var name="ThrottleInterval" default="30" />
            <var name="WantFrag" default="True" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="95">
            <var name="SigName" default="TCP NULL Packet" protected="true" />
            <var name="SIGID" default="3040" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Mask" protected="true" default="URG|ACK|PSH|RST|SYN|FIN" />
            <var name="PortRange" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="Axxx" />
            <var name="TcpFlags" protected="true" default="ZERO" />
            <var name="ThrottleInterval" default="30" />
            <var name="WantFrag" default="False" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="95">
            <var name="SigName" default="TCP SYN/FIN Packet" protected="true" />
            <var name="SIGID" default="3041" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Mask" protected="true" default="ACK|SYN|FIN" />
            <var name="PortRange" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="Axxx" />
            <var name="TcpFlags" protected="true" default="SYN|FIN" />
            <var name="ThrottleInterval" default="30" />
            <var name="WantFrag" default="False" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="95">
            <var name="SigName" default="TCP FIN Packet" protected="true" />
            <var name="SIGID" default="3042" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Mask" protected="true" default="ACK|SYN|FIN" />
            <var name="PortRange" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="Axxx" />
            <var name="TcpFlags" protected="true" default="FIN" />
            <var name="ThrottleInterval" default="30" />
            <var name="WantFrag" default="False" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="95">
            <var name="SigName" default="TCP FRAG SYN/FIN Packet" protected="true" />
            <var name="SIGID" default="3043" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="Mask" protected="true" default="ACK|SYN|FIN" />
            <var name="PortRange" default="1" />
            <var name="Protocol" default="TCP" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="Axxx" />
            <var name="TcpFlags" protected="true" default="SYN|FIN" />
            <var name="ThrottleInterval" default="30" />
            <var name="WantFrag" default="True" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="Netbios OOB Data" protected="true" />
            <var name="SIGID" default="3300" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="2.1.1" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="DstPort" default="139" />
            <var name="Mask" protected="true" default="URG" />
            <var name="Protocol" default="TCP" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="TcpFlags" protected="true" default="URG" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="75">
            <var name="SigName" default="Back Door Probe (TCP 36794)" protected="true" />
            <var name="SIGID" default="9023" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S40" />
            <var name="SigStringInfo" default="SYN to TCP 36794" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="DstPort" default="36794" />
            <var name="Mask" protected="true" default="FIN|SYN|RST|PSH|ACK|URG" />
            <var name="Protocol" default="TCP" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="TcpFlags" protected="true" default="SYN" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="75">
            <var name="SigName" default="Back Door Probe (TCP 10168)" protected="true" />
            <var name="SIGID" default="9024" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S44" />
            <var name="SigStringInfo" default="SYN to TCP 10168" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="DstPort" default="10168" />
            <var name="Mask" protected="true" default="FIN|SYN|RST|PSH|ACK|URG" />
            <var name="Protocol" default="TCP" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="TcpFlags" protected="true" default="SYN" />
            <var name="ThrottleInterval" default="30" />
          </entry>
        </array>
      </struct>
    </item>
    <item type="ATOMIC.UDP">
      <struct name="ATOMIC.UDP">
        <var name="version" protected="true">4.0</var>
        <array name="signatures">
          <entry dontDelete="true" nda="false" sfr="75">
            <var name="SigName" default="Snork" protected="true" />
            <var name="SIGID" default="4051" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1.6" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="DstPort" default="135" />
            <var name="Protocol" default="UDP" />
            <var name="SrcPort" default="7" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="75">
            <var name="SigName" default="Snork" protected="true" />
            <var name="SIGID" default="4051" protected="true" />
            <var name="SubSig" default="2" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1.6" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="DstPort" default="135" />
            <var name="Protocol" default="UDP" />
            <var name="SrcPort" default="9" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="75">
            <var name="SigName" default="Snork" protected="true" />
            <var name="SIGID" default="4051" protected="true" />
            <var name="SubSig" default="3" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1.6" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="DstPort" default="135" />
            <var name="Protocol" default="UDP" />
            <var name="SrcPort" default="135" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="Chargen DoS" protected="true" />
            <var name="SIGID" default="4052" protected="true" />
            <var name="SubSig" default="1" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1.6" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="DstPort" default="19" />
            <var name="Protocol" default="UDP" />
            <var name="SrcPort" default="7" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="Chargen DoS" protected="true" />
            <var name="SIGID" default="4052" protected="true" />
            <var name="SubSig" default="2" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="2.1.1.6" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="DstPort" default="19" />
            <var name="Protocol" default="UDP" />
            <var name="SrcPort" default="19" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="75">
            <var name="SigName" default="Chargen Echo DoS" protected="true" />
            <var name="SIGID" default="4061" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="low" />
            <var name="Enabled" default="False">True</var>
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S31" />
            <var name="SigStringInfo" default="chargen -&gt; echo" />
            <var name="AlarmThrottle" default="Summarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="DstPort" default="7" />
            <var name="Protocol" default="UDP" />
            <var name="SrcPort" default="19" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="85">
            <var name="SigName" default="IOS Udp Bomb" protected="true" />
            <var name="SIGID" default="4600" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="1.0" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="DstPort" default="514" />
            <var name="MinUDPLength" default="9" />
            <var name="Protocol" default="UDP" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="81">
            <var name="SigName" default="Invalid DHCP Packet" protected="true" />
            <var name="SIGID" default="4619" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="medium" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm" />
            <var name="SigVersion" default="S149" />
            <var name="SigStringInfo" default="crafted packet" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="DstPort" default="67" />
            <var name="MinUDPLength" default="248" />
            <var name="Protocol" default="UDP" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="Axxx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
        </array>
      </struct>
    </item>
    <item type="ATOMIC.IPOPTIONS">
      <struct name="ATOMIC.IPOPTIONS">
        <var name="version" protected="true">4.0</var>
        <array name="signatures">
          <entry dontDelete="true" nda="false" sfr="95">
            <var name="SigName" default="Strict Src Rte" protected="true" />
            <var name="SIGID" default="1006" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="2.1.1" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="IpOption" default="137" />
            <var name="Protocol" default="IP" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
        </array>
      </struct>
    </item>
    <item type="ATOMIC.L3.IP">
      <struct name="ATOMIC.L3.IP">
        <var name="version" protected="true">4.0</var>
        <array name="signatures">
          <entry dontDelete="true" nda="false" sfr="95">
            <var name="SigName" default="Impossible IP packet" protected="true" />
            <var name="SIGID" default="1102" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="2.1.1" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="isImpossiblePacket" default="True" />
            <var name="Protocol" default="IP" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="95">
            <var name="SigName" default="IP Localhost Source Spoof" protected="true" />
            <var name="SIGID" default="1104" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="2.2.1.1" />
            <var name="SigStringInfo" default="IP Localhost Source Spoof" />
            <var name="AlarmThrottle" default="FireOnce" />
            <var name="ChokeThreshold" default="100" />
            <var name="isLocalhost" default="True" />
            <var name="Protocol" default="IP" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="95">
            <var name="SigName" default="IP Packet with Proto 11" protected="true" />
            <var name="SIGID" default="1108" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="S27" />
            <var name="SigStringInfo" default="IP Proto 11" />
            <var name="AlarmThrottle" default="GlobalSummarize" />
            <var name="ChokeThreshold" default="100" />
            <var name="Protocol" default="IP" />
            <var name="ProtoNum" protected="true" default="11" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
          </entry>
          <entry dontDelete="true" nda="false" sfr="90">
            <var name="SigName" default="Ping Of Death" protected="true" />
            <var name="SIGID" default="2154" protected="true" />
            <var name="SubSig" default="0" protected="true" />
            <var name="AlarmSeverity" default="high" />
            <var name="Enabled" default="True" />
            <var name="EventAction" default="alarm|drop" />
            <var name="SigVersion" default="1.0" />
            <var name="AlarmThrottle" default="FireAll" />
            <var name="ChokeThreshold" default="100" />
            <var name="isIcmp" default="True" />
            <var name="isOverrun" default="True" />
            <var name="Protocol" default="IP" />
            <var name="StorageKey" default="xxxx" />
            <var name="SummaryKey" default="AxBx" />
            <var name="ThrottleInterval" default="30" />
            <var name="WantFrag" default="True" />
          </entry>
        </array>
      </struct>
    </item>
  </data>
</configuration>
