Threat Prevention Rule/Profile Matching

[cdav]

I have a custom threat policy with three rules defined for IDS purposes - no prevent. The rules have 3 different threat profiles:

• one for high performance impact and below,
• one for medium performance impact and below
• one for low/very low performance impact.

Each rule has a different protected scope. The high performance impact profile is at the top and the low performance impact profile is at the bottom.

In the logs I see the low performance impact rule detecting high performance impact protections.

I do not understand why. Is anyone able to advise or should I raise with TAC?

 

[G_W_Albrecht]

Better ask CP TAC for help - i can not see what you are trying to achieve and how ! If different GWs should have different IPS / TP policies, i can use a different profile for each GW. You sound as if the three profiles have the same target GW...

[cdav]

Maybe I have misunderstood the use of threat profiles. The intention is to have different levels of inspection based on the performance impact. 

E.g dev networks could have medium or below and production networks could have high or below. Each rule has a different protected scope.

[PhoneBoy]

You understand the purpose of the Threat Profiles correctly.
TAC may be necessary to figure out why this is protection is firing.

[cdav]

thank you @Timothy_Hall @the_rock 

[the_rock]

Always welcome!

[the_rock]

I am fairly sure you understood how threat prevention works just right. Lots of people do it exactly that way. Personally, I would try disable ips blade, push policy, re-enable, push policy again. If that doe snot fix it, would open TAC case.

Andy

[Timothy_Hall · Accepted solution]

This "Sensitive Configuration File Disclosure" protection was created very recently on 4/14/2025.  This may be a situation where the gateway automatically updated itself (if it is configured to do so), the gateway picked up this new signature in some network traffic and tried to log it, but there was a mismatch in the IPS database version between the two entities.  This can cause some rather strange logs to appear that don't always make sense.