IPS signature fine tune

[Roshan_Sinha]

Hi Team,

Recently i have enabled IDS for Low confidence IPS protections, just to analyze what all attacks are hitting to our firewall. As soon as I enabled IDS, i have strated receiving many attack events which are Internal servers to servers legitimate traffic however its detecting as attack with high severity but low confidence. 

Need your suggestion, on this scenario, what should be the best solution I have to apply to avoid events for legitimate traffic.

Not sure if I have to create exception list for particular source and destination to avoid unnecessary events.

All suggestions will be appreciable !!

Regards,

Roshan Sinha

[the_rock]

This is good reference link:

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_ThreatPrevention_AdminGuide/Topics...

Personally, I always tell people to stick with CP optimized profile, as in my experience, seems to work the best, meaning it will block most of commonly known stuff out on the Internet. Are you having issues with certain protections blocking the legitimate traffic?

[Roshan_Sinha]

HI,

Since i have enabled only IDS for low confidence protection, Its not blocking any traffic but only receiving Detect events for all legitimate traffic which is quite huge. 

[the_rock]

What is the current IPS profile you are using?

[Roshan_Sinha]

Its replica of Default CP Optimized profile.

[the_rock]

K, fair enough. I would follow below link for IPS optimizing. Honestly, I always use optimized profile with customers and never had any problems.

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_ThreatPrevention_AdminGuide/Topics...

[Blason_R]

That is my take as well - You will need to some extra effort to finetune the profile/signatures. Use reporting functionality and get the reports and see the top signatures which are firing that would help to finetune the rules

[Roshan_Sinha]

Thanks all for your suggestions..