09-21-2011 10:08 AM
I tried searching through the discussions but didn't see anything regarding this. Is it possible to see what the actual threats are matching on? Essentially what their signature is so I can make a more accurate analysis of the validity. For example, Scripts/Win32.Rsrc.o is classified as a Medium severity virus threat. The description is simply "This signature detected Scripts/Win32.Rsrc.o" which doesn't allow me to make any sort of knowledgeable decission regarding next-steps for investigation. I haven't dropped down to the CLI yet to see if it's possible to peer into the signatures and figure out what exactly is being keyed off in the packet, but I would hope this feature exists within the web UI.
In addition to the above, is it possible to modify the signatures and define what networks (src/dst) would be required to trigger it? Our company has a lot of home grown apps which trigger on things that are not malicious; however, I don't want my only available course of action to be excluded it entirely from triggering.
09-21-2011 12:21 PM
@jeff.white:
the signatures are not viewable by the end-user and this is by design. As a general rule we are not going to expose the details behind our threat detection methodology and signatures to end-users. If you want to have a detailed discussion on this topic I encourage you to talk to your sales team.
With regard to your second question: Yes this is possible if you create multiple threat (vulnerability/spyware/AV) profiles and apply them to security policies that are crafted to apply to specific source/destination FQDNs or IP addresses. Each threat profile can be tailored to specific environments/servers by using exclusions on specific threats that are not relevant for the traffic to/from the host/network.
-Benjamin
09-21-2011 11:29 AM
Looked in the CLI and the patterns are all encrypted (proprietary issue I assume). I also can't seem to find a way to edit the predefined signatures for the second part of my original post, just editing shared signatures you create yourself.
09-21-2011 12:21 PM
@jeff.white:
the signatures are not viewable by the end-user and this is by design. As a general rule we are not going to expose the details behind our threat detection methodology and signatures to end-users. If you want to have a detailed discussion on this topic I encourage you to talk to your sales team.
With regard to your second question: Yes this is possible if you create multiple threat (vulnerability/spyware/AV) profiles and apply them to security policies that are crafted to apply to specific source/destination FQDNs or IP addresses. Each threat profile can be tailored to specific environments/servers by using exclusions on specific threats that are not relevant for the traffic to/from the host/network.
-Benjamin
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
