IPS Protections in Detect (Staging)

[Tomer_Sole]

With R80.10, the new default profile "Optimized" sets all newly downloaded IPS protections to be in state "detect (staging)" or "inactive".

1. We start with the general page. It has settings in which a protection should be in detect, prevent, or inactive.

2. Then, in the "updates" page, we see that newly downloaded protections are automatically set to "Detect". This means that:

1. If a newly downloaded protection was supposed to be in "prevent", it will be set as "detect (staging)".
2. If a newly downloaded protection was supposed to be in "detect", it will be set as "detect (staging)".
3. If a newly downloaded protection was supposed to be in "inactive", it will remain inactive.

 

3. Sometimes an IPS update issues an update to an existing protection. In this case, the updated protection is back to "newly downloaded protection" state, which leaves it as either in "detect (staging)" or "inactive".

It is important to remember these things, because it requires you to manage your staging protections - otherwise they will not be in Prevent mode.

You can do that either from:

1. IPS Protections page with the filter for "Staging" status

 

2. Logs that appear in the query page for "IPS --> Staging"

You can also automate some of this work:

1. Apply additional configuration which excludes some protections from the "Detect (Staging)" status, leaving them with Prevent or Detect or Inactive.

 

2. Automatically change protections to Inactive based on tags.

3. Using the show threat-protections and set threat-protection API commands, you can create an automatic reaction which automatically changes the action from "Detect (Staging)" to "Prevent" or "Inactive" based on custom decision factors.

set threat-protection name "Aggressive Aging" overrides.remove.1 "New profile 1" overrides.remove.2 "New Profile 2"