updating IPS rules and applying them on fmc risks

[baselzind]

i have a fmc with 2 years old ips rules , is there a risk if  update the ips rules and applied them to a production environment?

[Mohammed al Baqari]

Hi,

Try to update IPS rules then run recommendation task. Once recommendation
is completed, try to apply the IPS rules. This is safer approach.

After couple of days of monitoring, you can tweak rules as needed.

**** please remember to rate useful posts

[Marius Gunnerud]

I agree with Mohammed here.

1. Disable inline drop

2. Run the generate recommended rules

3. Monitor for a few days to identify if there are any false positives

4. Activate inline drop

Once the rules are updated, I would suggest setting a scheduled task that updates the IPS rules on a regular basis.