IPS: How to Filter Events by CVE/Protection and Troubleshoot Signatures (Real-Time + Historical)

[WiliRGasparetto]

IPS: How to Filter Events by CVE/Protection and Troubleshoot Signatures (Real-Time + Historical)

If you need to answer questions like:

• “Is this CVE hitting my environment right now?”

• “Which IPS protection is generating blocks?”

• “Is this a false positive or a false negative—and how do I prove it?”

This runbook is the shortest path to evidence, not guesswork.

1) Start with the right identifier (Protection Name / Protection ID)

In SmartConsole:

• Go to Threat Prevention → Protections

• Search by:

  • CVE (when the protection references a CVE)

  • Product/vector keywords (e.g., “Log4j”, “Apache Struts”, “Exchange”)

• Record:

  • Protection Name

  • Protection ID (preferred for precision)

TAC note: CVE strings do not always appear in gateway logs. Protection ID is the most stable identifier.

2) Real-time filtering on the gateway (do this correctly)

2.1 Critical correction: fw.log is binary — don’t tail it

$FWDIR/log/fw.log is a binary log database.
tail -f $FWDIR/log/fw.log is not a valid way to read it.

Use:

fw log -ft

2.2 Filter by CVE / protection name / protection_id

Examples:

fw log -ft | egrep "CVE-2021-44228|Log4j|protection_id=1234567"

Multiple CVEs:

fw log -ft | egrep "CVE-2021-44228|CVE-2021-45046"

2.3 Refine by action (Detect vs Prevent) after you confirm the field

Log fields vary by version/output format. First identify how action is printed in your output, then filter.

Example (if your output includes action=😞

fw log -ft | egrep "protection_id=1234567" | egrep "action=Prevent"

TAC rule: never assume the exact label (“Action: Prevent”)—confirm it from the real output.

---

3) Historical search (recommended for accuracy and correlation)

For historical analysis, RCA, and audit-grade evidence, use SmartLog / SmartView Tracker on the Management Server.

Recommended filters:

• blade:IPS

• protection_id:<id>

• protection_name:"<name>"

• cve:"CVE-xxxx-xxxx" (only if the CVE is present in log metadata)

Why SmartLog is better than CLI for history

• time-windowed correlation

• grouping by source/destination/user

• consistent fields and exportable evidence

• better noise reduction under high-volume IPS events

4) Troubleshooting “IPS is blocking legitimate traffic” (false positive)

TAC workflow (without disrupting production)

1. Identify the event in SmartLog (or in real-time via fw log -ft)

2. Confirm Protection ID and context:

   • source/destination

   • protocol/application

   • profile and gateway role (perimeter vs internal)

3. Make a granular change:

   • set the specific protection to Detect temporarily, or

   • implement a scoped exception (object/group/segment) where applicable

4. Re-test and validate that:

   • the business flow is restored

   • security coverage remains acceptable

TAC rule: don’t “turn off IPS” to fix a false positive. Isolate the single protection and scope the exception.

5) Troubleshooting “IPS didn’t catch it” (false negative)

Most false negatives reduce to one of these:

• traffic is not traversing the gateway you think it is (wrong path)

• Threat Prevention policy is not installed on the gateway

• the protection is disabled or not in the expected action mode

• the traffic is not matching the expected protocol context (wrong port/app)

Evidence checklist

• IPS blade enabled on the gateway object

• Threat Prevention policy installed on the right gateways

• event path validation (routing/segmentation)

• protection enabled and in Detect/Prevent (not Inactive/Exception)

6) Quick operational health checks (gateway side)

Process sanity check (varies by version/blades, so keep it defensive):

cpwd_admin list | egrep -i "fwd|cpd|ips|pdp|fpd"

Load validation before changing profiles:

• cpview for CPU/memory/throughput

• confirm whether IPS “under load” behaviors are in play (bypass settings, etc.)

7) Official references (for documentation-grade backing)

• Threat Prevention Administration Guide (R81+)

• SK95193 — ATRG: IPS

•  

If you share a specific CVE (or Protection ID) and your gateway version (e.g., R81.20 / R82), I can provide:

• a ready-to-paste SmartLog query

• a hardened fw log -ft filter

• and a tuning checklist (Detect vs Prevent) aligned to perimeter/internal gateway roles.