cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post

How to handle IPS SMB filters with too many false positivs

Hi,

we use the IPS Blade functionality at enterprise FW level. We see and inspect client to server traffic in various internal network segments. However we face a huge amount of false positives, especially within the SMB IPS filter category.

I wonder how you cope with those false positives?

If we block these filters (severity critical) our users are no longer able to work. If we whitelist these filters as global execpetions for the whole network segment, we feel like we open up a potential security risk.

We don't want to whitelist the whole SMB filters for the whole network segments but at the same time we fear the increasing complexity of more and more unique exceptions.

What's your approach to these SMB filters and their false positive exceptions?

Looking forward to some suggestions.

Cheers,

Johanna

Tags (2)
2 Replies
Admin
Admin

Re: How to handle IPS SMB filters with too many false positivs

If you're having an excessive amount of false positives, you should probably work with the TAC: Contact Support | Check Point Software 

They can take some packet captures and work with our IPS team to adjust the signatures appropriately to limit this.

0 Kudos

Re: How to handle IPS SMB filters with too many false positivs

Hi,

thanks for the hint. I guess that's what we'll be doing with the packet captures.

0 Kudos