IPS Update in Detect Mode

[OLU_TSC]

Hi All,

Customer want me to configure the IPS update to be in Detect Mode
rather than in prevent mode. They want me to review the traffic for one week
before configring to Prevent mode.

My humble Question is
"How do I determine business impact of new IPS signatures against traffic
hits when in Detect Mode."

I have to give customer report and move the IPS Signature into Prevent mode after a week.

Regards,

Olu

[PhoneBoy]

You have to analyze the Detects to see if they involve any critical clients/servers as a starting point.
A protection that triggers regularly might be a false positive and/or might need further testing in Prevent mode in the lab before enabling in production.

[OLU_TSC]

Thanks PhoneBoy,

Can you please give an idea of how to analyse the Detect please.

example blade:IPS action:Detect XXXXXXXXX? What else can i use.

Thanks

[PhoneBoy]

That starts with knowing what the actual source and destination are and what applications are involved.
A signature that triggers for an application that isn't on the source/destination might be a false positive.
A lot of Detects for a given signature/source/destination may indicate a false positive also.

[the_rock]

We did this for client that became CP customer back in 2021 and we showed them that after 2 weeks of IPS being in detect mode, there were no false positives, which is good time to turn on optimized profile.

You can also use built in IPS report if you turn on smart event blade on the mgmt server. 

Best,

Andy

[Lesley]

You could enable IPS in detect only mode and let it log for a few days.

After some time review the logs and compare them to the profile you would like to activate to see what protections will be detected / prevented and inactive. Depending on the profile(strict or optimized) an protection will be set to a certain level depending on performance and confidence level. Also copy the standard profile so you can always work and edit a copy!

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_ThreatPrevention_AdminGuide/...

See under:

Troubleshooting IPS for a Security Gateway

[the_rock]

Thats an excellent reference.

Andy