Event Filters & Blocking

[awagih]

Dear All,

In fine tunning the IDSM/IDS for false positive alarms, I have configured the

IDS/IDSM for "Event Filter" the false alarms and at the same time I

have conmfigured my IDS/IDSm fo shunning/Blocking various networking devices

(PIX/Routers/Cat65xx), my question is:

Does the "Event Filter" confiuration is affected,sbujected to, by the

Blocking configuration. in other words if I configured the IDS for

"exclude event filter" a specefic signature that fired by a specefic

network, say NETWORK_1, and at the same time tunned this signature actime to

shun or block, does the filterd network, NETWORK_1, will be shunned/blocked if

the signature is fired although I exclude this network from the Event Alarms?

I apprecaite your help and cooperation

Thanks and best Regards

[marcabal]

This changes between 4.x and 5.x,

In 4.x if the alert is filtered, then the actions (like blocking and tcp reset) are also filtered.

NOTE: Be aware that in 4.x there are 2 types of filters. Exception True and Exception False. Exception False is the default and will prevent the signature from firing (and prevent the actions). But the exception True filter is an override, it overrides all the Exception False filters and forces the alert firing (and forces the actions).

In version 5.x each individual action can be filtered. So you can filter out produceAlert action and still allow the block actions to continue.

[awagih]

Thank you Marcoa, for your response.

Marcoa, you said "In 4.x if the alert is filtered, then the actions (like blocking and tcp reset) are also filtered", does this applies for all filtered signature regardless if the filtring action is configured for a specefic host/network or not? In other words if I filtered specefic signature that triggered from specefic host/network, does the filter will apply to this signature regardless who triggered it?

Thanks and best Regards

[marcabal]

If the alert is filtered by an Exception false filter (and not overridden by an Exception true) filter, then both the alert and the action together will be filtered/prevented.

To match a filter the alert has to match all of the matching criteria in the filter: (SigID, SubSigID, Src Address, Dest Address).

Only if all the criteria match the alert will the alert and it's associated actions be filtered.

If if any of the criteria does not match, then that filter line will be ignored for that specific alert.