What are IPS Staging Protections? And how do we clear them?

[Tomer_Sole]

In R80, following an IPS Update, newly downloaded protections are marked in "staging". This means that if their state according to the profile is Prevent or Detect, as long as the user doesn't clear the flag, it's marked as "Detect (staging)" with a little clock icon on top of it. Protections that should be inactive remain inactive.

The plan is that you can keep them in staging until you decide whether they should behave according the profile's settings, or override them with a different action, for example based on traffic after policy installation.

From the IPS Protections view, you can filter protections to only show the ones that are in Staging.

You can control this setting from the Profile Editor:

Clearing protections from Staging can be done from the IPS Protections view.

Please note that in order to change the staging counter, you have to clear a protection from staging in all IPS profiles, not just the ones that are seen on the screen. So either change the visible profiles to “all”:

or make sure you clear the staging status from all profiles by right-clicking the protection and selecting “restore to profile settings”.