Non-Stop Receiving Alert ID: 7002 "SERVER-SAMBA Samba Writeable Share Insecure Library Loading"

you have a IPS rule for the clients towards the FS.

create a IPS Policy that does not contain all the unrequired stuff like SAMBA.

here an example working for us:

at the bottom of your client to FS firewall rule, set this IPS policy:

would that be safe?  we can still be attack with that type of intrusions.

your fileserver is not unix, so you cannot attack it with unix based attacks. unselect everything else than windows and server

Look on the first screenshot: everything known for Platfowm Windows, Target Server is scanned.

fileserver_allow is something only of interest for our internal needs. your focus should be on the All Windows servers and Reconnaissance groups

of course, you should build a specific rule towards your fileserver only and put this IPS rule there.

all other servers should be protected by IPS rules based on their specific demand.

Sorry, just to clarify...

Is it safe to remove these IPS specific rules on the file server itself?  Because attacks can still happen on the file share server.

I understand you want IPS protection here from your clients to your Windows File Server. Currently you are checking every client access to your server for ALL known threads for every connection. That is unnecessary and causes false positives.

If you create a new rule with this filters, what else do you think you need?

thank you...
Is this what I should be doing?

no, now you would only drop (or detect) this single threat. what would be risky and you'd still get the mails

compare your screenshot with mine:

select all

Platform: windows

Target: server

edit:

while I answered you created an other reply with the second screenshot.if you select action: disable, you will still get alerts but the traffic will be allowed.

btw: SERVER-SAMBA Samba Writeable Share Insecure Library Loading is Platform: Linux / Unix, Target: Server

see the difference?

no, now you would only drop (or detect) this single threat. what would be risky and you'd still get the mails

compare your screenshot with mine:

select all

Platform: windows

Target: server

edit:

while I answered you created an other reply with the second screenshot.if you select action: disable, you will still get alerts but the traffic will be allowed.

btw: SERVER-SAMBA Samba Writeable Share Insecure Library Loading is Platform: Linux / Unix, Target: Server

see the difference?

There are only 2 options for "Action".  Which One?
1. Drop Packets
2. Drop Sessions

based on the picture you send above, I don't see the below part.  So these are what I did in the end.
Please correct me if I'm wrong...

Created a firewall rule to the file server.

if this rule is now (only) for the connection of your clients to your fileserver, I'd say the issue should fixed and you did it the right way. And still your server is IPS protected from attacks from your client network.