topic Re: Signature Tuning - Exception in Network Security

Signature Tuning - Exception

bill_martin — Sun, 10 Mar 2019 12:13:50 GMT

I would like to create exceptions within particular signatures to ignore IP addresses. How do I perform this task?

rhermes — Thu, 06 Jan 2011 21:01:47 GMT

You want to configure an Event Action Override for this IP address.

- Bob

Keith Craycraft — Fri, 07 Jan 2011 19:02:02 GMT

Bill,

I have found this is easier to do from the IME.

go to the configuration at the top and when the configuration screen comes up select polices button on the left side.

in the policy tree select IPS policies. you should have an event actions section from here you can select Add to create a new filter.

Below is what the screen will be like, using the Demo version of IME.

I would play with this feature in the demo version of IME before i tried it in production.

Hope this helps

Keith

bill_martin — Mon, 10 Jan 2011 17:36:16 GMT

Thanks for the help however neither method will work. We use CSM to manage the

devices and any change made locally will be overwritten by CSM!

rhermes — Mon, 10 Jan 2011 21:29:35 GMT

Bill -

You can create an Event Action Filter in CSM.

- Bob

bill_martin — Tue, 11 Jan 2011 14:49:14 GMT

Bob,

Thanks, I give it a try...

Bill