topic Re: Security Intelligence Does not block sometimes in Network Security

Security Intelligence Does not block sometimes

Wee2o — Wed, 14 Sep 2022 04:37:41 GMT

I have created security intelligence block list but sometimes it allows the connections like the one highlighted and it is identified as attackers.

Is that because the intrusion policy is set to detection not prevention?

Re: Security Intelligence Does not block sometimes

FredrikW73 — Wed, 14 Sep 2022 12:41:53 GMT

The Reason column seems to indicate that you have set the action to "Monitor-only" and not "Block" for that Security Intelligence category. If so, my understanding is that the result is that no requests are blocked, not even the lower four in your screenshot.

Re: Security Intelligence Does not block sometimes

Wee2o — Thu, 15 Sep 2022 03:54:50 GMT

The Monitor-Only on the intrusion policy not the security intelligence. will that affect it?

Re: Security Intelligence Does not block sometimes

FredrikW73 — Thu, 15 Sep 2022 07:56:27 GMT

Are you talking about the "Drop when inline" setting?

What is the mode of the device and type of interfaces?

This is the setting I mentioned:

Re: Security Intelligence Does not block sometimes

Wee2o — Thu, 15 Sep 2022 08:05:45 GMT

you are correct, I missed this settings. thank you!