Intrusion Prevention

Use intrusion prevention to detect and block network-based attacks.

To create a profile:

1. Log in as a Restricted Administrator.
2. In the tree menu, select Intrusion Prevention, and then select a profile category.
3. In the toolbar, click Create New.
4. Configure the profile settings, and click OK.

To clone an existing profile, right-click the profile in the content pane, and select Clone.

To edit a profile:

1. Log in as a Restricted Administrator.
2. In the tree menu, select Intrusion Prevention, and then select a profile category.
3. In the content pane, select a profile, and take one of the following actions:
   • In the toolbar, click Edit.
   • Right-click the profile, and select Edit.
4. Edit the settings, and click OK.

Name	The profile name.
Comment	Optionally, enter a description of the profile.
IPS Signatures	Click Add Signatures to add IPS signatures to the table. The signatures list can be filtered to simplify adding them. To add or edit a signature's IP exemptions, select a signature then click Edit IP Exemptions. Right-click on a signature to change the action (Pass, Monitor, Block, Reset, Default, or Quarantine), and to enable or disable Packet Logging. The CVE ID filter allows you to filter IPS signatures based on CVE IDs or with a CVE wildcard, ensuring that any signatures tagged with that CVE are automatically included. You can delay new signatures to avoid false positives. Signatures that are on hold will be set to Monitor rather than being disabled. If the signature is matched, the message Signature is on hold, is appended to the log.
IPS Filters	Click Add Filter to add IPS filters to the table. The filters list can be searched and filtered to simplify adding them. Right-click on a signature to change the action (Pass, Monitor, Block, Reset, Default, or Quarantine), and to enable or disable Packet Logging.
Rate Based Signatures	Enable the required rate based signatures, then configure its options: Threshold, Duration, Track By, Action, and Block Duration.
Advanced Options	Enable or disable blocking malicious URLs.

To add an IPS CVE filter:

1. Log in as a Restricted Administrator.
2. Go to Intrusion Prevention > Profiles.
3. Create a new profile or select the profile you want to update.
4. In the IPS Signatures and Filters section, create a new filter or select a filter to update. The Create New IPS Signatures and Filters dialog box is displayed.
5. Add the CVE filter.
   1. Click the Filter icon.
   2. Click Add Filter > CVE ID.
   3. Enter the CVE ID, then click Use Filters, and click OK.
6. Click OK.

To delay an IPS signature activation:

1. Log in as a Restricted Administrator.
2. Go to Device Manager > Device & Groups.
3. Select a managed device.
4. In the toolbar, click CLI Configuration. To display the menu, see CLI Configurations menu.
5. In configurations menu, go to System > IPS. The system ips dialog box is displayed.
6. Ensure override-signature-hold-by-id is enabled.
7. In the signature-hold-time field, enter the number of days or hours hold and monitor the IPS signatures. For example, 1d12h