How to assign a group of filtered signatures to Profile IPS /TP?

[Javier002]

Hello,

I´m trying to create a Threat profile that only contains a group of selected signatures with: Threat Year > 2015 AND Confidence Level = Hight AND Severity = Critical, High. Is this possible? Because you can filter with those parameters but I can´t find how to create a profile filtering with them.

Thanks in advance.

[G_W_Albrecht · Accepted solution]

First, set the General Policy as wanted. I suggest not to use Detect in Activation Mode:

Then, instead of activating selected signatures with: Threat Year > 2015 only, just deactivate all signatures with: Threat Year < 2016:

With Protections to Activate Any you can be sure to get all the newest protections activated (if they fall into your General Profile). As there is no Year: 2021 you would not get newer protections than 2020 activated if you use a Threat Year list here...