HCP - Threat Prevention Protections impact

[Piet_vd_Maas]

Hi All,

When I'm looking to my HCP report under Threat Prevention > Protections > Protections Impact I see a lot of 'Applictions' instead of IPS.

The applications that are in the report aren't configured in any rule. Is there a way to finetune this?

SmartConsole Extensions Threat Prevention 

[Tal_Paz-Fridman]

Adding @Andy_Yelnik 

[Timothy_Hall]

If you have an APCL/URLF rule with Service & Application set to "Any" also with Detailed Logging set (such as the cleanup rule), overhead will be expended identifying & logging these applications which is what you are seeing in hcp.  You can set Track for these rules to just "Log" but the specific applications matching this rule will no longer be detected and logged.

[Piet_vd_Maas]

Hi Timothy,

The only rules that these applications can hit are the 'Cleanup Rules' with action Drop and track Log.

We've 1 other rule to block traffic to internet with action Reject but only track Log

[Piet_vd_Maas]

Is there a way to find the rule(s) that is/are responsible for this traffic?

[the_rock]

I also saw that in web version of HCP for R81.20, but did not pay much attention to it.

Andy