topic Re: IPS policy signature disabling technologies in Network Security

IPS policy signature disabling technologies

rick11 — Fri, 21 Feb 2020 17:20:10 GMT

Hello community,

I have a simple problem using signatures updates in IPS policy. Each update bring new signatures obviously but also a lot of false positives for us. The idea is, I have alerts for "D-Link" signatures, I don't want to see anymore those signatures since it does not apply to the customer enviroment. I tried to work with the categories available.

Is it possible to exclude or disable some signatures to avoid downloading them in the next updates? How do you usually manage this?

Thank you!

Riccardo

Re: IPS policy signature disabling technologies

rick11 — Mon, 11 Sep 2023 12:30:02 GMT

Anyone have any feedback? thank you

Re: IPS policy signature disabling technologies

Marvin Rhoads — Mon, 11 Sep 2023 15:24:24 GMT

Any new D-Link signatures that may be included in the next update would be downloaded automatically. You cannot choose to download only signatures you want and exclude others.

Any Internet-facing resources will get lots of scans looking for well-known vulnerabilities, including those that apply exclusively to D-link. Not having any D-Link in the protected network won't stop the firewall from blocking those scans as they are known by Cisco Talos to be malicious traffic. However, they should be assigned level 3 or 4 impact levels (Not vulnerable or Unknown Target).

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/admin/720/management-center-admin-72/events-intrusion.html#ID-2211-000004aa

Re: IPS policy signature disabling technologies

rick11 — Tue, 12 Sep 2023 10:16:12 GMT

Thank you for feedback, so there is no way to limit signatures, unless disabling the category itself on an upper layer? Is there a description how the signatures layers and firepower reccomendations works toghether?
Thanks!

Re: IPS policy signature disabling technologies

Marvin Rhoads — Wed, 13 Sep 2023 13:36:23 GMT

@rick11 there are some Cisco Live presentations that cover IPS rules and layers. Most recently, see BRKCRT-2466 which can be found here: https://www.ciscolive.com/on-demand/on-demand-details.html?#/session/16360601080850017e86

Re: IPS policy signature disabling technologies

rick11 — Sat, 16 Sep 2023 15:26:08 GMT

thank you for sharing, I'll take a look!