How to handle IPS SMB filters with too many false positivs

[Johanna_Müller]

Hi,

we use the IPS Blade functionality at enterprise FW level. We see and inspect client to server traffic in various internal network segments. However we face a huge amount of false positives, especially within the SMB IPS filter category.

I wonder how you cope with those false positives?

If we block these filters (severity critical) our users are no longer able to work. If we whitelist these filters as global execpetions for the whole network segment, we feel like we open up a potential security risk.

We don't want to whitelist the whole SMB filters for the whole network segments but at the same time we fear the increasing complexity of more and more unique exceptions.

What's your approach to these SMB filters and their false positive exceptions?

Looking forward to some suggestions.

Cheers,

Johanna

[PhoneBoy]

If you're having an excessive amount of false positives, you should probably work with the TAC: Contact Support | Check Point Software 

They can take some packet captures and work with our IPS team to adjust the signatures appropriately to limit this.

[Johanna_Müller]

Hi,

thanks for the hint. I guess that's what we'll be doing with the packet captures.