IPS Protection Overrides

[Steve_Pearson]

I'm currently removing the legacy IPS layer from the policy on an R81.20 deployment.

In the summary section it shows "1 Override" (see attached), which appears to be a link, but when I click it I get a list of protections (either full list or filtered list)

So the question is, how do I find this 1 override, so that I can ensure I copy it to the new TP policy?

Thanks

[AkosBakos]

Hi Steve,

My first idea is this the Inspection Settings

And by the Threat Prevention policy

Check which one has been overridden.

Akos

[Steve_Pearson]

I've found it now but by manually scrolling through the list, as I couldn't see a way to get it to show me just the one with an override. Is there a way to do this, or is it always going to be a manual task?

[AkosBakos]

I haven't faced such kind of issue in my life. But if the link didn't work, it seems you should check it one-by-one. I hope the Legends will correct me, and I will learn something new again today. 🙂

The list is not too long.

Akos

[Timothy_Hall · Accepted solution]

Just use the "User Modified" filtering checkbox under Activations to find them:

You can also undo all User Modification overrides at once under the Actions...Profile Cleanup menu:

[AkosBakos]

Not in vain, the legends. 🙂