Hi,
we use the IPS Blade functionality at enterprise FW level. We see and inspect client to server traffic in various internal network segments. However we face a huge amount of false positives, especially within the SMB IPS filter category.
I wonder how you cope with those false positives?
If we block these filters (severity critical) our users are no longer able to work. If we whitelist these filters as global execpetions for the whole network segment, we feel like we open up a potential security risk.
We don't want to whitelist the whole SMB filters for the whole network segments but at the same time we fear the increasing complexity of more and more unique exceptions.
What's your approach to these SMB filters and their false positive exceptions?
Looking forward to some suggestions.
Cheers,
Johanna
