About fredallee

It's not clear based on the info in the link provided. Do you have an MD5 of the infection file so that we can verify coverage? Alfred ... View more

Regarding the not-resolved issues, there's a known issue in 3.1 code surrounding not-resolved URLs. We anticipate a fix for the issue in 3.1.6. If you are seeing high numbers of not-resolved URLs, please contact support. ... View more

Thanks for your comments. We have indeed brought up this issue with BrightCloud and have asked them to review and make adjustments to their automated classification engine. As they work on this, please don't stop submitting miscategorization issues like this as it will help them to continue to train their engine to make it more accurate. If it makes it any easier, instead of submitting them one by one to BrightCloud, you can simply email support with a spreadsheet of URLs. Then, we can get them to BrightCloud for immediate re-categorization. Thanks, Alfred ... View more

You're right that we have set each vulnerability ID to perform the most suitable action. So, they are essentially our recommended actions for most networks. The low and informational severity attacks are not turned on for the default profile because they may fire on more common events like an HTTP options request, which in and of itself is legitimate traffic, but could also indicate that someone is looking to see what resources are available on a web server. This event could precede an attack on a web server. So it depends on whether or not you want to see these types of events or not. If you select default for low and informational severity signatures, you will start to see these types of events being logged. Alfred ... View more

The NSS test was only for vulnerability protection (IPS), so they didn't have any of the other security profiles set. The default actions were set for all vulnerability protection signatures. In the default profile, the critical, high and medium severity signatures are turned on using the default action associated with each signature, which is either block or alert. The low and informational signatures are not turned on, meaning that they would not be logged. If you would like to see those at least get alerted, simply create a new vulnerability protection profile and select alert as the action for low and informational severity signatures. Alfred ... View more

Nando, Thanks for your question. NSS Labs offers different types of testing. We participated in the standalone public IPS test. The test results are either given a rating of recommend, neutral, or caution. We received the highest rating of recommend. The Gold, Approved, and Tested awards are applied to their monthly testing service called Security Update Monitor(SUM). Please refer to the NSS Labs page for more details on the SUM testing and ratings: http://nsslabs.com/SUM. The bottom of the page states, "Starting Q1, 2009, NSS Labs awards participating IPS products at the end of each quarter. All vendors are invited to test monthly, and the average of three months scores are used to determine the award level. NSS Labs Gold will be awarded for accuracy above 95%, Approved above 70% and Tested for all other results." Let me know if you have any other questions. Thanks, Alfred ... View more

Default and Tuned settings for the NSS Labs tests were as follows: Default - Using a default vulnerability protection profile which sets default actions for all severities of signatures. Tuned - All severities of signatures set to block. NSS Labs does not count alerting on an attack as being detected. It must block. In the default profile, many of our signatures are set to alert rather than block and were then not counted in the effectiveness. Alfred ... View more

Yes, you are correct in that we should show the custom categories as a possible condition when managing custom reports. This was logged as a bug and will be fixed in a future release. Alfred ... View more

Sounds like a bug. Have you opened a support case for this? ... View more

1. Customized severity for threats is not currently possible. 2. Blocking all medium severity vulnerabilities shouldn't block apps. If you want to block the brute force attacks, then I would turn on blocking for medium severity for server side vulnerabilities. Alfred ... View more

You could do this via a custom vulnerability profile, but the drawback is that you need to manually add newly released signatures. Alfred ... View more

I understand. We have a closed system where we don't show any of the signatures on our box except for the custom created regex signatures that are created by administrators. The only method that we have for fixing signatures is currently through us. So if there are false positives, please let support know and we will tune the signature and release a new update. In the meantime, customers can create an exception for that signature so that it's effectively disabled. Alfred ... View more

Yes. Alfred ... View more