topic Re: IPS Update in Detect Mode in Firewall and Security Management

IPS Update in Detect Mode

OLU_TSC — Mon, 18 Mar 2024 15:57:13 GMT

Hi All,

Customer want me to configure the IPS update to be in Detect Mode
rather than in prevent mode. They want me to review the traffic for one week
before configring to Prevent mode.

My humble Question is
"How do I determine business impact of new IPS signatures against traffic
hits when in Detect Mode."

I have to give customer report and move the IPS Signature into Prevent mode after a week.

Regards,

Olu

Re: IPS Update in Detect Mode

PhoneBoy — Mon, 18 Mar 2024 16:25:10 GMT

You have to analyze the Detects to see if they involve any critical clients/servers as a starting point.
A protection that triggers regularly might be a false positive and/or might need further testing in Prevent mode in the lab before enabling in production.

Re: IPS Update in Detect Mode

OLU_TSC — Mon, 18 Mar 2024 17:11:10 GMT

Thanks PhoneBoy,

Can you please give an idea of how to analyse the Detect please.

example blade:IPS action:Detect XXXXXXXXX? What else can i use.

Thanks

Re: IPS Update in Detect Mode

PhoneBoy — Mon, 18 Mar 2024 23:09:34 GMT

That starts with knowing what the actual source and destination are and what applications are involved.
A signature that triggers for an application that isn't on the source/destination might be a false positive.
A lot of Detects for a given signature/source/destination may indicate a false positive also.

Re: IPS Update in Detect Mode

the_rock — Tue, 19 Mar 2024 00:49:10 GMT

We did this for client that became CP customer back in 2021 and we showed them that after 2 weeks of IPS being in detect mode, there were no false positives, which is good time to turn on optimized profile.

You can also use built in IPS report if you turn on smart event blade on the mgmt server.

Best,

Andy

Re: IPS Update in Detect Mode

Lesley — Tue, 19 Mar 2024 12:55:31 GMT

You could enable IPS in detect only mode and let it log for a few days.

After some time review the logs and compare them to the profile you would like to activate to see what protections will be detected / prevented and inactive. Depending on the profile(strict or optimized) an protection will be set to a certain level depending on performance and confidence level. Also copy the standard profile so you can always work and edit a copy!

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_ThreatPrevention_AdminGuide/Topics-TPG/Troubleshooting.htm?Highlight=%22detect%20only%22#Troubleshooting_IPS_for_a_Security_Gateway

See under:

Troubleshooting IPS for a Security Gateway

Re: IPS Update in Detect Mode

the_rock — Tue, 19 Mar 2024 13:29:37 GMT

Thats an excellent reference.

Andy