Threat Prevention

[nabil_l]

Can any one provide me some info regarding Threat Prevention and Exception.

I have attached screenshot of my lab environment.

After log show IPS detect and i was doing exception for that particular only and selected Apply on Matched Rule. Now i am not able to find where that exception output is located.

I am searching where that entry is recorded. Can anyone guide me.

[AkosBakos]

Hi @nabil_l 

I suppose that, you are searcing for this:

[nabil_l]

Hello AkosBakos,

Thank you for your response.  As per my screenshot when I try to add exception and Apply on = Add to global Exception Group (Apply on All Rules), it will show on the same tab as you have share on screenshot, but when I click on Apply on = Apply on match rule I was not able to see any record same like you have mentioned.

[AkosBakos]

Hi @nabil_l 

Have you choosen the right policy? I mean that, if you have more policies, you are searcing in the right one?

A

[nabil_l]

That is the lab environment and newly created VM Gateway, I was just testing exception case on IPS. So there is no more setting or config. I have only created one IPS strict profile clone and it detected on IPS event in log and by right clicking on that specific log I click on add exception, but when at last I click on Apply on = Apply on match rule, I am not able to see any exception. I just want to know where that record are saved so that in future I can again remove for exception.

[nabil_l]

Can you just provide me some info on how exception work when we finaly click one of the two option i have highlighted in my picture.

[AkosBakos]

Hi @nabil_l 

I see, and what about that rule, where the trafic hts the IPS rule? There was't created a layer for the excepton?

A

[nabil_l]

Traffic hit the IPS rule and exception was created but i didnt find where is the entry for that exception when i want review that exception.