Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Michael_Horne
Advisor

Some Signature show Detect even profile is set to prevent

Hello All,

I am investigating the issue of why some IPs logs are showing the action "Detected" in stead of "Prevented" as per the TP Policy. We can see from the logs that the log4js is being logged as "Detect". the log entry shows that it is matching the expected TP policy rule, using the correct TP Profile.  The TP Profile is set up to Prevent anything with Confidence level Medium that is included.

The one thing I notice is that the destination for the traffic is the public IP of the FW itself and that for some reason this affects the FWs ability to "Prevent" the traffic in the IPS.

The Logs show that the lo44js is only Detected:

log.png

The policy rule matched is set up to prevent things of medium confidence or higher:

Policy.png

We can see that the log4js protections are set to "Prevent"

log4j.png

Is the destination being the FWs public IP on port 80 what is causing the strange behaviour?

Many thanks,

Michael

0 Kudos
5 Replies
Michael_Horne
Advisor

Hello,

These SKs seem related to Threat Emulation, I can understand for blades that must process or analyze a file, that if the mode is set to background, then on the first instance the file is passed and the second one would be blocked. 

The issue we are facing is for IPS signature where the stream is being scanned. My understanding was that IPS signatures should be able to block the first instance.

Regards,

Micahel

0 Kudos
G_W_Albrecht
Legend
Legend

See that zero Bytes have been sent/received ? But better open a SR# with TAC to get the reason for this message ! 

CCSE CCTE SMB Specialist
0 Kudos
Michael_Horne
Advisor

Hello,

 

I see 0 Bytes sent and 548 bytes received on teh log entry. I have a TAC case open for the issue.

zaoar
Explorer

Hi Michael, 

did you have any luck with this? I have same issue with AntiVirus blade.

 

0 Kudos