topic Re: Some Signature show Detect even profile is set to prevent in Firewall & Security Management

Some Signature show Detect even profile is set to prevent

Michael_Horne — Tue, 21 Jun 2022 05:34:50 GMT

Hello All,

I am investigating the issue of why some IPs logs are showing the action "Detected" in stead of "Prevented" as per the TP Policy. We can see from the logs that the log4js is being logged as "Detect". the log entry shows that it is matching the expected TP policy rule, using the correct TP Profile. The TP Profile is set up to Prevent anything with Confidence level Medium that is included.

The one thing I notice is that the destination for the traffic is the public IP of the FW itself and that for some reason this affects the FWs ability to "Prevent" the traffic in the IPS.

The Logs show that the lo44js is only Detected:

The policy rule matched is set up to prevent things of medium confidence or higher:

We can see that the log4js protections are set to "Prevent"

Is the destination being the FWs public IP on port 80 what is causing the strange behaviour?

Many thanks,

Michael

Re: Some Signature show Detect even profile is set to prevent

G_W_Albrecht — Tue, 21 Jun 2022 09:00:30 GMT

sk106119: Threat Emulation blade generates a "Detect" log instead of "Prevent" log

here also listed in sk106119 are:

Re: Some Signature show Detect even profile is set to prevent

Michael_Horne — Wed, 22 Jun 2022 12:21:49 GMT

Hello,

These SKs seem related to Threat Emulation, I can understand for blades that must process or analyze a file, that if the mode is set to background, then on the first instance the file is passed and the second one would be blocked.

The issue we are facing is for IPS signature where the stream is being scanned. My understanding was that IPS signatures should be able to block the first instance.

Regards,

Micahel

Re: Some Signature show Detect even profile is set to prevent

G_W_Albrecht — Wed, 22 Jun 2022 12:47:31 GMT

See that zero Bytes have been sent/received ? But better open a SR# with TAC to get the reason for this message !

Re: Some Signature show Detect even profile is set to prevent

Michael_Horne — Wed, 22 Jun 2022 13:45:25 GMT

Hello,

I see 0 Bytes sent and 548 bytes received on teh log entry. I have a TAC case open for the issue.

Re: Some Signature show Detect even profile is set to prevent

zaoar — Mon, 15 Aug 2022 09:12:41 GMT

Hi Michael,

did you have any luck with this? I have same issue with AntiVirus blade.