Some Signature show Detect even profile is set to prevent

[Michael_Horne]

Hello All,

I am investigating the issue of why some IPs logs are showing the action "Detected" in stead of "Prevented" as per the TP Policy. We can see from the logs that the log4js is being logged as "Detect". the log entry shows that it is matching the expected TP policy rule, using the correct TP Profile.  The TP Profile is set up to Prevent anything with Confidence level Medium that is included.

The one thing I notice is that the destination for the traffic is the public IP of the FW itself and that for some reason this affects the FWs ability to "Prevent" the traffic in the IPS.

The Logs show that the lo44js is only Detected:

The policy rule matched is set up to prevent things of medium confidence or higher:

We can see that the log4js protections are set to "Prevent"

Is the destination being the FWs public IP on port 80 what is causing the strange behaviour?

Many thanks,

Michael

[G_W_Albrecht]

sk106119: Threat Emulation blade generates a "Detect" log instead of "Prevent" log

here also listed in sk106119 are:

• sk115252 - Threat Emulation logs show "Detect" for e-mail attachments instead of "Prevent" when Thre...
• sk113627: Although Threat Emulation engine settings inside profile set to "Hold", Threat Emulation s...
• sk110625: Threat Emulation detects a Malicious file even if the action is set to Prevent

[Michael_Horne]

Hello,

These SKs seem related to Threat Emulation, I can understand for blades that must process or analyze a file, that if the mode is set to background, then on the first instance the file is passed and the second one would be blocked. 

The issue we are facing is for IPS signature where the stream is being scanned. My understanding was that IPS signatures should be able to block the first instance.

Regards,

Micahel

[G_W_Albrecht]

See that zero Bytes have been sent/received ? But better open a SR# with TAC to get the reason for this message ! 

[Michael_Horne]

Hello,

I see 0 Bytes sent and 548 bytes received on teh log entry. I have a TAC case open for the issue.

[zaoar]

Hi Michael, 

did you have any luck with this? I have same issue with AntiVirus blade.