Blocking Signatures

[helvey-johnson]

I have converted from CSPM to MC to monitor my IDS-4210’s. In CSPM you could choose what signatures not to report. How can I set MC to ignore certain signatures?

[gfullage]

You can either set up a filter for them under the Filter section, or turn the signature off completely under the Signatures section.

[helvey-johnson]

Where do I find these sections? I looked under VPN/Security Managment Soultion section?

[gregrack]

Under VPN/Security Management | Management Center, choose "IDS Sensors". From there, click on the Configuration tab, then choose settings.

You will have to go to the Object Selector and choose the sensor you wish to filter. You can NOT set the filters by group! :P Once you've chosen a sensor, you will find "filters" under the TOC. After that, it is fairly self-explanatory. Getting there is MORE than half the battle.

Once you've configured your first sensor, you can use the "copy" option from under the Configuration tab to copy all filters to other similar sensors.

Good luck!