This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPS just monitoring and bloc only some signatures.

Hi,
I would like to configure my IPS on the Sophos UTM 9.2 like this.
I would like to monitor the traffic with the IPS but no blocking.
But for some signatures for example hear bleed CVE-2014-0160, I would like to block traffic which matches with the signature of CVE-2014-0160.

Is it possible to configure the UTM like this? I couldn't manage this so far.
Or is there a good resource to learn more about this?

This thread was automatically locked due to age.

Parents

0 TheDrew over 11 years ago

Hi keamas,

The UTM's IPS is based off SNORT so you can access their database here: Snort :: Search. Just search for the rules you need (supports searching by CVE) and insert their SID's into the UTM as FrankBarmenlto suggested.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 TheDrew over 11 years ago

Hi keamas,

The UTM's IPS is based off SNORT so you can access their database here: Snort :: Search. Just search for the rules you need (supports searching by CVE) and insert their SID's into the UTM as FrankBarmenlto suggested.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data