About SCCDavek

davido140 wrote: Just used heartbleed in the threat name on the rule in the Vuln' protection profile and set the action to block This forces traffic to be dropped for the "medium" severity threats related to heartbleed in the 430 update. Effect from one of the online tests will be a timeout and you'll get an event in the threat log. The target system MUST be vulnerable to trigger these signatures, if you've already patched it you wont see anything in the logs. Ah, so you made a custom Vulnerability Protection profile then applied that to your security policies. . That makes sense. Thank you! ... View more

davido140 wrote: Thank you! Got it all working perfectly now at several locations. I also created a custom rule to block/drop those medium severity signatures in the latest update, this results in the online tests failing too (malformed response) to give clients some extra peace of mind. Seeing a large number of IPs from China trying to exploit this! Several days of replacing SSL certificates ahead of me now! What parameters did you use to trigger this rule?  I'm not seeing any way to trigger on a threat ID or anything like that.:smileyconfused: ... View more