Threat Prevention Rules, Exceptions, Default Actions Precedence

bruce.johnson — Tue, 22 Aug 2023 17:54:51 GMT

I want to confirm the order of precedence for security profile rules, default actions, and exceptions. For example, the default action for the SSH User Authentication Brute Force Attempt threat is alert. However, the threat profile rule associated (simple-server-high) has an action of reset-both. I think the rule action will override the default action of the signature meaning that the action of reset-both will be taken. Is that correct?

As a follow up, in that scenario I also have exceptions for a few IPs with that use the default action of alert. I think the exception will take precedence and the action will be to alert. Is that correct?

To summarize, I think rules override the default action but exceptions override both the rules and original default action when an exception is enabled. Is that correct?

Re: Threat Prevention Rules, Exceptions, Default Actions Precedence

ymiyashita — Wed, 23 Aug 2023 04:49:24 GMT

Yes, that should be how it works. Please report it here if you actually get a different result.

Re: Threat Prevention Rules, Exceptions, Default Actions Precedence

Rokibul — Thu, 22 Aug 2024 04:44:34 GMT

topic Re: Threat Prevention Rules, Exceptions, Default Actions Precedence in Advanced Threat Prevention Discussions

Threat Prevention Rules, Exceptions, Default Actions Precedence

Re: Threat Prevention Rules, Exceptions, Default Actions Precedence

Re: Threat Prevention Rules, Exceptions, Default Actions Precedence