https://community.cisco.com/t5/network-security/ips-false-positives/m-p/3049612#M43169 <P>Please see the below links which might be helpful.<BR /><BR /><A href="https://supportforums.cisco.com/video/11927666/ips-false-positive-prevention-event-action-filters" target="_blank">https://supportforums.cisco.com/video/11927666/ips-false-positive-prevention-event-action-filters</A><BR /><BR /><A href="http://www.cisco.com/c/en/us/support/docs/security/ips-4200-series-sensors/13876-f-pos.html" target="_blank">http://www.cisco.com/c/en/us/support/docs/security/ips-4200-series-sensors/13876-f-pos.html</A><BR /><BR /><A href="http://www.cisco.com/c/en/us/support/docs/security/intrusion-prevention-system/113575-tune-ips-eaf-00.html" target="_blank">http://www.cisco.com/c/en/us/support/docs/security/intrusion-prevention-system/113575-tune-ips-eaf-00.html</A><BR /><BR />Hope to help.</P> Thu, 09 Feb 2017 13:35:18 GMT syeda3 2017-02-09T13:35:18Z https://community.cisco.com/t5/network-security/ips-false-positives/m-p/3049611#M43168 <P>Can following be termed as false positives in Intrusion Prevention System (IPS) ?</P> <P></P> <TABLE width="548" style="border-collapse: collapse; width: 411pt;"> <TBODY> <TR style="height: 15.0pt;"> <TD width="35" style="height: 15.0pt; width: 26pt;">1</TD> <TD width="513" style="border-left: none; width: 385pt;">Application is not used in the entire infrastructure</TD> </TR> <TR style="height: 15.0pt;"> <TD style="height: 15.0pt; border-top: none;">2</TD> <TD style="border-top: none; border-left: none;">Events where victim IP address does not exist</TD> </TR> <TR style="height: 15.0pt;"> <TD style="height: 15.0pt; border-top: none;">3</TD> <TD style="border-top: none; border-left: none;">Application is not hosted on the server any more and .vhd file has been deleted</TD> </TR> <TR style="height: 15.0pt;"> <TD style="height: 15.0pt; border-top: none;">4</TD> <TD style="border-top: none; border-left: none;"> <P>Signature which has triggered an event for a particular application does not exist on the victim device</P> </TD> </TR> </TBODY> </TABLE> Sun, 10 Mar 2019 13:46:08 GMT https://community.cisco.com/t5/network-security/ips-false-positives/m-p/3049611#M43168 Reshma Raje 2019-03-10T13:46:08Z https://community.cisco.com/t5/network-security/ips-false-positives/m-p/3049612#M43169 <P>Please see the below links which might be helpful.<BR /><BR /><A href="https://supportforums.cisco.com/video/11927666/ips-false-positive-prevention-event-action-filters" target="_blank">https://supportforums.cisco.com/video/11927666/ips-false-positive-prevention-event-action-filters</A><BR /><BR /><A href="http://www.cisco.com/c/en/us/support/docs/security/ips-4200-series-sensors/13876-f-pos.html" target="_blank">http://www.cisco.com/c/en/us/support/docs/security/ips-4200-series-sensors/13876-f-pos.html</A><BR /><BR /><A href="http://www.cisco.com/c/en/us/support/docs/security/intrusion-prevention-system/113575-tune-ips-eaf-00.html" target="_blank">http://www.cisco.com/c/en/us/support/docs/security/intrusion-prevention-system/113575-tune-ips-eaf-00.html</A><BR /><BR />Hope to help.</P> Thu, 09 Feb 2017 13:35:18 GMT https://community.cisco.com/t5/network-security/ips-false-positives/m-p/3049612#M43169 syeda3 2017-02-09T13:35:18Z