IPS Staging - Clear Filtered Protections

[kleppard]

Hi All,

We have a customer who are running on our R80.20 MDS and have the IPS Blade. Over the last couple of years they have been running IPS Updates and Protections have been brought in into Staging Mode, however these have not then been reviewed and an action set.

We are now in a position where we have just over 11k protections with 10k in staging mode (Picture Attached) We have updated the settings to clear staging mode on any new updates however we would like to set the recommended actions based on profile to all of the existing protections.. however we would like to filter this out to specific criteria each time e.g.

Window 1 - Clear protections from Staging Mode - Severity: Critical, Confidence: High, Performance Impact: Low

Window 2 - Clear protections from Staging Mode - Severity: High, Confidence: Medium, Performance Impact: Low

and so on..

I understand there is an option for profile clean up to remove all staging which is great however we do not want to apply it to all signatures at once and the alternative I can see is to filter down manually and highlight the protections however we can only do 200 at a time in the Smart Console.

Does anyone know of a way we can clear staging per filter?

Thanks in advance

[Shiran_Gold]

Hey,

using GUI there is no way to change per type, other than the way you mentioned - filter and manually change (which is indeed limited to 200).

I believe you will be able to achieve that by building a script using threat-protections API.

thanks,

Shiran

[kleppard]

Hi Shiran,

Thanks for getting back to me - are you aware of any API Scripts that have been created for this?

Thanks

Kieran

[Shiran_Gold]

Hey,

unfortunately no,

To be honest, I would do it manually.

per window 1 request, there are 183 signatures available 

per window 2 there are 283 available 

(see attached pictures)

I understand the some windows may take more than 2-3 iterations..  but IMO its the fastest way 🙂

hope this helps.

Thanks,

Shiran

[kleppard]

Hi Shiran,

Thanks for the response - unfortunately the real window 2 is over 3000 signatures, I will take a look into the API and report back if I manage to find a solution

Kieran

[Shiran_Gold]

thanks for your feedback.

I wonder what's the difference from what I saw.

let me know if you encounter issues.

you are welcome to contact me offline too and I hope I will be able to assist if needed.

wish you a great day.