IPS Event Showing "would have dropped" as inline result

MSJ1 — Wed, 26 Jan 2022 18:22:34 GMT

I observed whenever “Inline Result” generated “would have dropped” action , traffic processed by the IPS Policy ( INTPOL-01v1 from the Image ) which is called at Advanced Section of Actual Policy ( Perim-01 1st Image ).

Even though “Drop when inline” action is “No” for this IPS Policy ( INTPOL-01v1 ) that means even though individual signature action is “Drop and Generate Events” it will not DROP Traffic. ?

However at each rule, IPS Policy Perim-01 is called and its “Drop when InLine” Action is YES and specific signature is “Drop and Generate Events” so ultimately when IPS Policy at each Rule is Processed this same traffic is Blocked ? for the Log/traffic which showed "would have dropped" .

Re: IPS Event Showing "would have dropped" as inline result

Jason Maynard — Sat, 29 Jan 2022 01:50:29 GMT

When you select “No” to drop when inline the results regardless of the settings enabled for the rule is NOT to drop the traffic - hence the message would have dropped. This effectively turns the policy into an IDS based policy. If the intention is to drop traffic you need to select “yes” to drop when inline - this effectively turns the policy into an IPS based policy.

topic Re: IPS Event Showing "would have dropped" as inline result in Endpoint Security

IPS Event Showing "would have dropped" as inline result

Re: IPS Event Showing "would have dropped" as inline result