Who rated this post

cancel
Showing results for 
Search instead for 
Did you mean: 
Timothy_Hall
Legend Legend
Legend

My interpretation is that Threat Prevalence is how relevant the particular threat is to a typical environment today.  A Threat Prevalence of Obsolete probably indicates that the threat is against obsolete systems and applications (think Windows NT, Windows XP, etc. - essentially software that has not been supported in a VERY long time).  As mentioned in my IPS Immersion Class, these Additional Activations will never forcibly reactivate a protection that does not meet the current Confidence, Performance Impact, & Severity criteria for the IPS profile.  As such the "Protections to Activate" Window is not generally very useful.  However the "Protections to Deactivate" window CAN be useful, as it can deactivate numerous protections that currently meet the three criteria but are not relevant to your environment at all, and save the firewall overhead associated with looking for matches on those signatures.

If you'd like to see for yourself which IPS Protections are tagged with the "Obsolete" designation you can search for them as shown in this screenshot which shows a protection that dates from 1999:

obsolete.jpg

 

ips_additional.jpg

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
(1)
Who rated this post