Vulnerability Protection Profile - Trigger Values in Exceptions

njuttner — Mon, 15 May 2017 16:46:36 GMT

Hi,

I'm having trouble understanding how trigger value adjustments work in Vulnerability Protection Profiles when IP exemption lists are used.

I've looked online but not found anything that is 100% clear.

I've created a Vulnerability Protection Profile.

I've added an exception for a specific threat ID & added a selection of IPs and set them to alert.

I've also adjusted the default trigger value.

Does the adjusted trigger value act on only the IPs in the exception list or does it act on the whole Vulnerability Protection Profile I've created.

Thanks in advance.

Re: Vulnerability Protection Profile - Trigger Values in Exceptions

acc6d0b3610eec313831f7900fdbd235 — Sat, 17 Jun 2017 04:36:34 GMT

@njuttner

Exemptions column is used to Add IP address filters to a threat exception. When you add an IP address to a threat exception, the threat exception action for that signature will take precedence over the rule's action only if the signature is triggered by a session with either a source or destination IP address matching an IP address in the exception.

You can add up to 100 IP addresses per signature. You must enter a unicast IP address (that is, an address without a netmask), such as 10.1.7.8 or 2001:db8:123:1::1.

By adding IP address exemptions, you do not have to create a new policy rule and new vulnerability profile to create an exception for a specific IP address.

topic Vulnerability Protection Profile - Trigger Values in Exceptions in Advanced Threat Prevention Discussions

Vulnerability Protection Profile - Trigger Values in Exceptions

Re: Vulnerability Protection Profile - Trigger Values in Exceptions