AnsweredAssumed Answered

How to handle IPS SMB filters with too many false positivs

Question asked by fb63d0ed-41a5-422e-8ebc-c70afa69c914 on Jan 11, 2018
Latest reply on Jan 15, 2018 by fb63d0ed-41a5-422e-8ebc-c70afa69c914


we use the IPS Blade functionality at enterprise FW level. We see and inspect client to server traffic in various internal network segments. However we face a huge amount of false positives, especially within the SMB IPS filter category.

I wonder how you cope with those false positives?

If we block these filters (severity critical) our users are no longer able to work. If we whitelist these filters as global execpetions for the whole network segment, we feel like we open up a potential security risk.


We don't want to whitelist the whole SMB filters for the whole network segments but at the same time we fear the increasing complexity of more and more unique exceptions.


What's your approach to these SMB filters and their false positive exceptions?

Looking forward to some suggestions.