cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
162
Views
0
Helpful
2
Replies
Beginner

IE Action Handler Overflow

Has anyone else been seeing large occurences of this signature from what appears to be normal web application/browsing activity? No further tuning of the sig has been performed.

2 REPLIES 2
Beginner

Re: IE Action Handler Overflow

Just waiting on the tuned sig - I hope, I hope, I hope. If it doesn't come soon, we'll have to filter it or turn it off.

Highlighted
Cisco Employee

Re: IE Action Handler Overflow

If you are seeing that signature firing, that means you or your users are browsing a web page including more than 2000 script action handlers.

That is possible but shouldn't be so common. I'd suggest to increase the Event Count value to something bigger.

The risk in this case would be to miss a real attack.

CreatePlease to create content
Content for Community-Ad
July's Community Spotlight Awards
This widget could not be displayed.