How to assign a group of filtered signatures to Profile IPS /TP?

Javier002 — Mon, 14 Jun 2021 10:20:33 GMT

Hello,

I´m trying to create a Threat profile that only contains a group of selected signatures with: Threat Year > 2015 AND Confidence Level = Hight AND Severity = Critical, High. Is this possible? Because you can filter with those parameters but I can´t find how to create a profile filtering with them.

Thanks in advance.

Re: How to assign a group of filtered signatures to Profile IPS /TP?

G_W_Albrecht — Mon, 14 Jun 2021 14:56:57 GMT

First, set the General Policy as wanted. I suggest not to use Detect in Activation Mode:

Then, instead of activating selected signatures with: Threat Year > 2015 only, just deactivate all signatures with: Threat Year < 2016:

With Protections to Activate Any you can be sure to get all the newest protections activated (if they fall into your General Profile). As there is no Year: 2021 you would not get newer protections than 2020 activated if you use a Threat Year list here...

topic How to assign a group of filtered signatures to Profile IPS /TP? in Firewall and Security Management

How to assign a group of filtered signatures to Profile IPS /TP?

Re: How to assign a group of filtered signatures to Profile IPS /TP?