Greetings,
I come from a Tippingpoint background and am now working with Firesight/Firepower.
We have hosts that trigger an HTTP rule that is set to Drop.
The traffic is valid and we do not want to drop it for this rule but we need all other http traffic from these hosts inspected.
Is manually creating new copy of the Rule with the 'Pass' option for the affected hosts the only way to achieve this?
This seems cumbersome and at risk of human error causing something bad to occur. Plus we'll have to monitor for changes to the original Rule to keep the new one up to date.
If I understand the options:
Using Suppress wont work as it only suppresses the events - the action is still Dropped
Using a Trust (in this case) wont work because the source generates the event against many destinations and maintaining the list not achievable.
Disabling the rule will remove detection of actual infected systems.
Which leaves the above Pass rule method.
We expect to see a number of these false positive requirements in the environment so having the best practice to handle them at the start will be most helpful.
Regards,
John
