topic Re: HTTP OPTIONS Method in General Topics

HTTP OPTIONS Method

simsim — Wed, 10 May 2017 05:43:04 GMT

Hi,

I am getting contionous 'HTTP OPTIONS Method' - alert
What is the reason for this

If I have multiple vulnerabilty profile ,I want to exclude this from one of the profile or one of the ip
(I want to ignore this vulnerabilty checking in a profile or against an IP)
How can i do that ?

Thanks

Re: HTTP OPTIONS Method

santonic — Wed, 10 May 2017 07:22:12 GMT

The reason is that some traffic matches the signature for this alert. Would need to check details of the signature and traffic to analyze why exactly it matches and if it's a false positive.

If you want to ignore this alert just from (or to) few IP addresses make an exception in that IPS profile.

If you want to ignore this alert for all traffic make a rule in IPS profile which sets this signature to allow

Re: HTTP OPTIONS Method

simsim — Wed, 10 May 2017 08:58:05 GMT

Hi,

The reason is that some traffic matches the signature for this alert. Would need to check details of the signature and traffic to analyze why exactly it matches and if it's a false positive.

How to begin the analyziz

2)I believe there are two ways we can do the exception
One from under monitor-threats

second from profiles

Please correct me if i wrong ?

If you want to ignore this alert for all traffic make a rule in IPS profile which sets this signature to allow?

can you expalin this

Thanks

Re: HTTP OPTIONS Method

santonic — Wed, 10 May 2017 12:07:44 GMT

For analysis: read the signature description, capture the traffic, see if the destination server is vulnerable etc.

Both ways to exempt IP address are equivalent. From threat monitor is just a shortct to exemptions in IPS profile.

You can make a rule which includes just this signature and set it to allow (like there are rules for other signatures, usualy defined by sevirity). It's same as make an exception just for this signature.