Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Zocki82
Participant

Dropping instead of rejecting SAM rules created by SmartEvent Automatic Block Reactions

Hello all,

we are using SmartEvent in our R80.20 Jumbo Hotfix Take 118 enviroment for quite a while to track suspicious activities such as DoS attacks.

Like designed for DDoS attacks, we use the automatic reaction "block event activity", to block multiple sources for this type of event. Unfortunately, when such an event occures, the automatically created SAM rule in SmartviewMonitor only rejects the traffic. When manually creating a SAM rule, you can configure the type of action (Notify/Reject/Drop).

I couldn't find the option in the R80.20 Logging and Monitoring AdminGuide or anything else, to (globally) set this Action from SmartEvent created SAM rules from Reject to Drop. Does anyone have an idea?

Best regards
Oliver

0 Kudos
1 Reply
Zolocofxp
Collaborator

This is a great question and sad no one got to answer it. I'm yet to find a workaround, I also want to drop instead of reject.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events