Attack Patterns - Rule Age

Hi,

By default, IPS patterns are restricted to those dating from the last 12 months. Depending on individual factors like overall patch level, legacy systems, or other security requirements, you can select another time span. Selecting a shorter time span will reduce the number of rules and thus improve performance.

You can refer https://community.sophos.com/kb/en-us/120329, to understand IPS configuration.

Thanks

Hi,

By default, IPS patterns are restricted to those dating from the last 12 months. Depending on individual factors like overall patch level, legacy systems, or other security requirements, you can select another time span. Selecting a shorter time span will reduce the number of rules and thus improve performance.

You can refer https://community.sophos.com/kb/en-us/120329, to understand IPS configuration.

Thanks

Hi sachingurung,

thank you for your answer.

My sophos has enough performance. I activated every rule (with warnings), but Intrusion Prevention is only active with 21627 of 27704 patterns.

Do you have experience with full activated IPS? Maybe it´s too dangerous.

Best regards

Hi, Rene, and welcome to the UTM Community!

The only rules activated are those selected and then only if the application is enabled in WebAdmin.

There are false positives, but the rules that generate them will be modified by Snort.  Other than that, there's no danger.

Cheers - Bob