IPS "Clear Staging" does not change Indicator

[Vladimir]

When IPS getting updates, those are placed in a "Staging" mode, indicated by the yellow "Detect" icon with superimposed blue clock face.

Right click allows you to perform "Clear Staging" action, that supposed to take effect after the "Threat Prevention Policy" is installed:

However, there is no change in the icon that signifies that the particular protection was cleared. There is only an increment of the unpublished changes:

Should the changes be published, the counter is zeroed-out, but the protection icon remains the same.

Furthermore, even after "Clear Staging" action on protection is performed, it is still remains as an active option in the right-click menu for the same protection. This makes it impossible to discern what protections were cleared from staging until after policy installation:

Will this be fixed in R80.20 or is there any other way to discern which protections were cleared and what will be the resultant action on them once they have been cleared?

Thank you,

Vladimir  

[Tomer_Sole]

Hi, I think that this is an issue with the GUI. I suppose restarting the app will show it as cleared as expected.

We would like to fix that as a jumbo update for R80.10. Please open a support request.

[Vladimir]

Tomer, I've opened the Service Request # 1-9973763231.

Suggested course of action from CP was to filter the protections by selecting "Staging" checkbox and to clear those from there.

Doing that does remove cleared protections from filtered list, but it does not tell you what the resultant action according to your policy will be.

Additionally, it still does not address the issue with "Clear" action being available from all protections view with the results described above.

So it does look like GUI issue that need be addressed.

Thank you,

Vladimir

[Tomer_Sole]

Are you sure that was the correct SR number? I can't seem to find it.

[Vladimir]

[Tomer_Sole]

OK, thank you. TAC updated us that they are on it.

[Vladimir]

Tomer,

TAC is requesting additional info from me, but I am already done with this project and just wanted to bring this issue to your attention.

Since it is easily reproducible in lab environment, can you may be let them know to take over this issue without me being involved?

Thank you. 

[Tomer_Sole]

We will add this issue. Thanks.

[Vladimir]

Thank you!

vlad@eversecgroup.com

+1.973.558.2738

[Vladimir · Accepted solution]

From Check Point:

Dear Vladimir,

RE: IPS Clear Staging does not change appearance of the protection

                 Just an update for you.  Development has found the issue and are working on a fix.  ETA unknown at this moment.

[Vladimir]

From Check Point:

RE: IPS Clear Staging does not change appearance of the protection

              This should be a part of the next HFA.