topic Exclude threat from alerting on IPS in General Topics

Exclude threat from alerting on IPS

RobinClayton — Tue, 20 Feb 2018 09:31:20 GMT

How can I effectivly remove alerts for specific threats on our IPS tap?

There are some that we are aware are actualy trivial and can't be fixed but cause a lot of alerts.

Is simply adding it as an Exception on the Vulnerability Profile enough? I tried this and did get a number of alerts afterwards.

Cheers

Rob

BPry — Tue, 20 Feb 2018 14:01:21 GMT

Specifically being picked up by the Vulnerability Profile?

If that's the case you should be able to modify the action to 'allow' and you should lose any logging or alerts.

RobinClayton — Tue, 20 Feb 2018 16:58:22 GMT

I saw a solution that mentioned that, but hovering ove action just gives "Filter"

I have managed to get it done on the LOGFORWAD filter instead.

Thanks

Rob