topic Re: Threat Prevention in Firewall and Security Management

Threat Prevention

nabil_l — Tue, 30 Jul 2024 08:58:14 GMT

Can any one provide me some info regarding Threat Prevention and Exception.

I have attached screenshot of my lab environment.

After log show IPS detect and i was doing exception for that particular only and selected Apply on Matched Rule. Now i am not able to find where that exception output is located.

I am searching where that entry is recorded. Can anyone guide me.

Re: Threat Prevention

AkosBakos — Tue, 30 Jul 2024 14:35:58 GMT

Hi @nabil_l

I suppose that, you are searcing for this:

Re: Threat Prevention

nabil_l — Tue, 30 Jul 2024 14:45:06 GMT

Hello AkosBakos,

Thank you for your response. As per my screenshot when I try to add exception and Apply on = Add to global Exception Group (Apply on All Rules), it will show on the same tab as you have share on screenshot, but when I click on Apply on = Apply on match rule I was not able to see any record same like you have mentioned.

Re: Threat Prevention

AkosBakos — Tue, 30 Jul 2024 14:48:49 GMT

Hi @nabil_l

Have you choosen the right policy? I mean that, if you have more policies, you are searcing in the right one?

Re: Threat Prevention

nabil_l — Tue, 30 Jul 2024 14:53:28 GMT

That is the lab environment and newly created VM Gateway, I was just testing exception case on IPS. So there is no more setting or config. I have only created one IPS strict profile clone and it detected on IPS event in log and by right clicking on that specific log I click on add exception, but when at last I click on Apply on = Apply on match rule, I am not able to see any exception. I just want to know where that record are saved so that in future I can again remove for exception.

Re: Threat Prevention

nabil_l — Tue, 30 Jul 2024 14:56:23 GMT

Can you just provide me some info on how exception work when we finaly click one of the two option i have highlighted in my picture.

Re: Threat Prevention

AkosBakos — Tue, 30 Jul 2024 15:05:13 GMT

Hi @nabil_l

I see, and what about that rule, where the trafic hts the IPS rule? There was't created a layer for the excepton?

Re: Threat Prevention

nabil_l — Tue, 30 Jul 2024 15:12:06 GMT

Traffic hit the IPS rule and exception was created but i didnt find where is the entry for that exception when i want review that exception.