Threat Prevention Rule matching, once more

[David_C1]

Hi everyone,

I'm about 90% there with my understanding of rule matching with Threat Prevention layers, but have one specific question:

Assume I have one Threat Prevention layer with two rules

Rule 1:
Protected Scope: Network A
Enabled Blade: IPS

Rule 2:
Protected Scope: Network A
Enabled Blade: Anti-Bot

I would separate like this because I may want different match settings for each blade (e.g. for Activation Mode for IPS, have "Prevent" for only High Confidence and "Detect" for Medium and Low Confidence; for Activation Mode in Anti-Bot, have "Prevent" for High and Medium Confidence).

Question: If traffic matches a signature in Rule 1, but the signature is in "Detect" Mode (it is a Low Confidence IPS signature) would it also be inspected in Rule 2? In this case, would the only way the traffic would be inspected by Anti-Bot would be to have a separate Ordered Layer for Anti-Bot?

Thanks,

Dave

[Timothy_Hall]

Rule 1 will be matched against the Network A Protected Scope and only IPS will be applied, rule 2 will not be matched as you can only match one TP rule per individual TP layer.

If you take rule 2 out of that TP layer and put in a new, separate TP layer then yes both rules would be matched and the most restrictive action applied, unless an exception exists.

[David_C1]

Thank you,

That's what I expected, but wanted to confirm.

Dave