Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 2 subscribers
  • Views 1202 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPS question

xax
When I look at the dashboard I see:

Intrusion Prevention is active with 1677 of 20691 patterns

As far as I can tell I have all IPS attack patterns turned on. I would expect to see "20691 or 20691 patterns" in use then.

Can someone clear that up for me?


This thread was automatically locked due to age.
Parents
  • 0
    Can you upload a screenshot of the "attack patterns"-tab?

    IS everything checked?(this includes the "include extra warnings",
    Is there any rule age set different then "no time limit"?

    edit:
    If I uncheck all extra warnings, I end up with 6230 of 20691 patterns,
    With all extra warnings checked, I end up with 20680 of 20691 patterns(11 disabled manually in the last IPS-config tab)
Reply
  • 0
    Can you upload a screenshot of the "attack patterns"-tab?

    IS everything checked?(this includes the "include extra warnings",
    Is there any rule age set different then "no time limit"?

    edit:
    If I uncheck all extra warnings, I end up with 6230 of 20691 patterns,
    With all extra warnings checked, I end up with 20680 of 20691 patterns(11 disabled manually in the last IPS-config tab)
Children
  • 0 in reply to FrankBarmentlo
    Can you upload a screenshot of the "attack patterns"-tab?

    IS everything checked?(this includes the "include extra warnings",
    Is there any rule age set different then "no time limit"?

    edit:
    If I uncheck all extra warnings, I end up with 6230 of 20691 patterns,
    With all extra warnings checked, I end up with 20680 of 20691 patterns(11 disabled manually in the last IPS-config tab)


    Yeah, after you mentioned the extras I enabled a few and did see the count increase on the dashboard. Guess I'll just leave it as default for now. Thanks for the response!