topic Re: Threat Details in General Topics

Threat Details

sib2017 — Sun, 12 Feb 2017 15:32:03 GMT

Hi,

What is Exempt profile here ,

Since severity is informational , Do we need to care about this ?

What if we don't want alert or any action if the severity is informational ?

Is it good practice just one rule in an antispyware profile ?

Thanks

Re: Threat Details

reaper — Mon, 13 Feb 2017 08:26:15 GMT

Hi @sib2017

The exempt profile means that someone made an exception for this threat to NOT be monitored by the profile in the list

so any security policy where this profile is used will not hit on this threat

If the profile is used in internal policy or if the threat i 'to be expected' due to how your TLS infrastructure is set up, it may not be sonething to worry about... best is to figure out who set it and why 🙂

I would recommend to have at least a few rules in the AntiSpyware (and AV and threat) profiles to take different approaches to each severity

i usually have all kinds of bells and whistles (block-ip, extended packetcapture) for critical and high, less bells for medium and low, and simply alerting for informational , i touch on this in this video 🙂 Tutorial: Configuring Your Security Policy

Re: Threat Details

sib2017 — Mon, 13 Feb 2017 09:28:32 GMT

Hi,

Thanks reaper .You mean this threat was never monitored by the spyware profile which is used in my security rules 1 ...10 (for example),
So how can I add or delete from this exempted list ?
If this threat was exempted in this profile , how the PA did an action (reset-both) in the list as below

Thanks

Re: Threat Details

reaper — Mon, 13 Feb 2017 10:55:12 GMT

ah wait, i made a booboo

that first screenshot you showed is the log info, not the profile info of that threat

in the LOG detail view you can check that box next to the profile to add an exception for that threat to that profile

to take it out you need to go into the profile and remove the threatID from the exceptions tab

but uhm... your action is set to alert in the profile while the policy is reset both, is this the same profile ?

if you have a profile with only 1 rule set to alert, nothing should be blocked

Re: Threat Details

sib2017 — Mon, 13 Feb 2017 14:39:25 GMT

Hi,

Sorry I am little confused .

"in the LOG detail view you can check that box next to the profile to add an exception for that threat ".

if you are talking aboot the first pic in my post , I can add only ip address .

That means i can exempt only ip address there ?

So in my case It was not exempted .

"your action is set to alert in the profile while the policy is reset both, is this the same profile ?

if you have a profile with only 1 rule set to alert, nothing should be blocked "

No ,it was " reset-both ", Then i Changed to alert

Thanks

Re: Threat Details

reaper — Tue, 14 Feb 2017 08:52:20 GMT

ok, sorry for the confusion! let's start from the beginning 🙂

in the LOG view, you can open the threat details. you can add exceptions in here based on the IP address or the profile

this view simply allows you to add an exception for the IP involved or the whole profile, so you don't need to go into the objects tab, find the profile, go to the exceptions tab, try to remember the threat ID and then add an exception.

I hope i made it more clear 🙂