topic R81.10 - Block/Prevent notification for IPS events in Firewall and Security Management

R81.10 - Block/Prevent notification for IPS events

Martin_Hofbauer — Mon, 05 Dec 2022 02:18:30 GMT

I am searching for ideas to inform our users, when a IPS protection takes effect - like Usercheck is doing it.

Thanks for any ideas

Martin

Re: R81.10 - Block/Prevent notification for IPS events

Tal_Paz-Fridman — Mon, 05 Dec 2022 08:12:46 GMT

Would you like to notify the Security Administrator or the user that triggered the specific IPS Protection?

Re: R81.10 - Block/Prevent notification for IPS events

Blason_R — Mon, 05 Dec 2022 08:37:51 GMT

Hey,

You can get it from Smartevent and trigger the notification when the action is matched.

Go to the Log & Monitor Tab -> Smart Event Settings & Policy

Create action as Email and then you can defined the triggers there

Re: R81.10 - Block/Prevent notification for IPS events

Blason_R — Mon, 05 Dec 2022 08:41:19 GMT

This might help

Re: R81.10 - Block/Prevent notification for IPS events

Chris_Atkinson — Mon, 05 Dec 2022 09:19:07 GMT

Many attacks for which IPS applies may not be due to an interactive user session or in a browser.

Whilst UserCheck provides both an agent and email configuration options it's currently most relevant to the likes of Anti-virus / Anti-bot in the Threat Prevention context.

Re: R81.10 - Block/Prevent notification for IPS events

Timothy_Hall — Mon, 05 Dec 2022 12:55:40 GMT

The IPS blade is not capable of sending UserChecks to the end user, and will simply start dropping packets or in some cases issue a TCP reset (whether a particular IPS protection performs a drop or reject upon a prevent action cannot be changed). So if a user gets blocked but doesn’t seem to see a UserCheck, the IPS blade may well be responsible. This was covered in my IPS/AV/ABOT Immersion course.

Re: R81.10 - Block/Prevent notification for IPS events

the_rock — Mon, 05 Dec 2022 13:28:58 GMT

I agree with @Blason_R . I see same options in R81.20 as well and seems best way to do this.

Re: R81.10 - Block/Prevent notification for IPS events

Martin_Hofbauer — Mon, 05 Dec 2022 17:33:27 GMT

That was exactly my motivation for asking this question. But as already answered, the only way to notify my users that an IPS protection has blocked a specific connection is with SmartEvent notifications. But how do I inform the users without installing an agent... Email would be ok, but I need to map the client's IP address to the user - So I need IA Blade active! (?) plus a script that collects the appropriate information. Sounds complex and maybe things changes in a future release ...

Thanks for all your answers !

Re: R81.10 - Block/Prevent notification for IPS events

maddah87 — Tue, 26 Sep 2023 04:17:03 GMT

Hi @Blason_R ,

This IPS reaction cannot have dynamic e-mail addresses, can it?
Means that if a user blocked by the IPS can it be notify to the specific user in every case.

Re: R81.10 - Block/Prevent notification for IPS events

Chris_Atkinson — Tue, 26 Sep 2023 06:14:17 GMT

As discussed it's not really geared for end user notification, rather the SOC etc.

Re: R81.10 - Block/Prevent notification for IPS events

maddah87 — Tue, 26 Sep 2023 06:50:11 GMT

Thanks, 🙏