topic Re: Adding ThreatPrevetion exceptions by setting action to PREVENT to eliminate possibility of False in General Topics

Adding ThreatPrevetion exceptions by setting action to PREVENT to eliminate possibility of FalseNegs

Tiger_QAs — Tue, 02 Feb 2021 19:49:44 GMT

Hello All,

I have a question regarding addition of exceptions to a Threat Prevention policy on perimeter gateways.

BackGround:
Few servers are running DNS queries to external honeypot site and not all of them are getting prevented by Anti-Bot, Few logs show "Detect" too.

I would like to write an exception on TP policy and set the action to "Prevent", I want to try it to eliminate the possibility of any false negatives. (Refer to the attached image for the exception rule that I wanted to try)

My question is : Is it normal to write TP exceptions and set action to prevent ?

Re: Adding ThreatPrevetion exceptions by setting action to PREVENT to eliminate possibility of False

Cyber_Serge — Tue, 02 Feb 2021 21:46:46 GMT

I think for the DNS Query, if you configure DNS Trap, it will show "Detect" instead of "Prevent". So seeing "detect" for those might be normal, depend on your setting.

Re: Adding ThreatPrevetion exceptions by setting action to PREVENT to eliminate possibility of False

Tiger_QAs — Tue, 16 Feb 2021 21:59:12 GMT

Thanks a lot for the response @Cyber_Serge

Re: Adding ThreatPrevetion exceptions by setting action to PREVENT to eliminate possibility of False

Timothy_Hall — Wed, 17 Feb 2021 14:24:43 GMT

Yes, support for TP exceptions with an action of Prevent (instead of the usual Detect or Inactive) was added in R80.10.