Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
-K-
Contributor
Jump to solution

Regarding IPS Update

Hi

If we have auto update disabled for IPS Signature update, and also disabled the automatic Activation of IPS protection.

1) How to make sure/review  which Protections / Signatures are downloaded recently & staged to install on GWs

2)how to review to understand whether it can cause an issue with an existing infrastructure based on application behavioral.

Any input please would be highly appreciated.

0 Kudos
1 Solution

Accepted Solutions
emmap
Employee
Employee

1. If you've disabled auto-updates, you will not have any recently downloaded protections. When you do have auto-updates enabled, new/updated protections are flagged for follow-up. You can filter based on what's flagged for follow-up in the IPS Protections part of SmartConsole. I would recommend clearing all the currently flagged protections using the Cleanup Options to give yourself a clean baseline. Once you've assessed a new protection and decided what to do with it, clear the follow-up flag.

2. This is what 'Staging' is for. New protections that would auto-activate based on the profile settings (based on configured severity and performance impact settings) activate in detect mode. This will assess the traffic against the protection and produce a 'detect' log if it would block something, without actually blocking it. With this information, you can decide whether this is a protection that you would like to enable in protect mode (simply clear the 'staging' flag from the protection and it will auto-activate into prevent mode) If you assess it to be a false positive, you can override the automatic setting into the appropriate mode.

The follow-up flags and auto-activation settings are there to assist you in putting together a process around managing IPS protections. Just make sure that you keep up with it, else you'll end up with hundreds of protections in staging mode and not actually have any protection benefit from the IPS blade. 

View solution in original post

0 Kudos
1 Reply
emmap
Employee
Employee

1. If you've disabled auto-updates, you will not have any recently downloaded protections. When you do have auto-updates enabled, new/updated protections are flagged for follow-up. You can filter based on what's flagged for follow-up in the IPS Protections part of SmartConsole. I would recommend clearing all the currently flagged protections using the Cleanup Options to give yourself a clean baseline. Once you've assessed a new protection and decided what to do with it, clear the follow-up flag.

2. This is what 'Staging' is for. New protections that would auto-activate based on the profile settings (based on configured severity and performance impact settings) activate in detect mode. This will assess the traffic against the protection and produce a 'detect' log if it would block something, without actually blocking it. With this information, you can decide whether this is a protection that you would like to enable in protect mode (simply clear the 'staging' flag from the protection and it will auto-activate into prevent mode) If you assess it to be a false positive, you can override the automatic setting into the appropriate mode.

The follow-up flags and auto-activation settings are there to assist you in putting together a process around managing IPS protections. Just make sure that you keep up with it, else you'll end up with hundreds of protections in staging mode and not actually have any protection benefit from the IPS blade. 

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events