IPS Protection for Scanning my Infrastructure

[Daniel_Hainich]

hi,

there are many unknown public ip´s which are accessing my public servers with https. it seems like they are scanning my infrastructure with a low rate, so they are flying under the radar.

is there any ips protection which can help to block them? geoip would be an option, but maybe there is an better solution?

thanks

daniel

[G_W_Albrecht]

All on public servers gets digested by new AI Startups, i think 😉  But why use GeoIP ?

[Daniel_Hainich]

i dont want use geoip, but maybe it would an option to block locations like brasil or other countrys. my fist option is to enable an ips protection for such scanning. is there anything?

[G_W_Albrecht]

There is this IPS feature: sk110873: How to configure Security Gateway to detect and prevent port scan

[Daniel_Hainich]

i think port scan isnt the right feature, because its always https. host port scan is per descritption " if IPS detects that a client is attempting to access 100 different inactive ports within a 30 second time frame".

so there are any other options to prevent it?

[PhoneBoy]

An IPS Protection probably won't work for this particular situation, especially since this is a "low and slow" thing and the traffic they are using isn't necessarily malicious.
What evidence do you have this is occurring?
Based on this, you might be able to make an automatic reaction with SmartEvent, which would use a SAM rule to block the traffic.

[Daniel_Hainich]

i need to check the log-files from the affected systems to see what they are doing. but in term that they are  scanning the systems for particular urls or doing some unwanted requests, i want to block them.

i take a look at smart event. but based on my other question - are sam rules working with maestro?

[PhoneBoy]

In order to do any sort of detailed scanning of HTTPS traffic (regardless of method), you will need to implement HTTPS Inspection inbound.

SAM rules are not supported in Maestro currently, so a SmartEvent-based trigger might be off the table.