Prefilter Analyse to ACP

[GRANT3779]

Hi CSC, 

If we have a prefilter policy and there is a line with action to anslyse, i know this is then sent to the ACP. What I am wondering is, does there also need to then be an ACP line to match that same traffic again or is is sent directly to the snort engine from the prefilter rule?

[Ajay Saini]

Hello,

You would need another ACP that matches traffic and action set as allow to be able to send to IPS or Malware engine for further analysis.

If the traffic does not match any ACP rule, then it will go to default action which can be set as multiple actions like block all or IPS policy etc.

HTH
AJ