Hello community,
we are operating Cisco IPS sensors connected to FTD, however we noticed the category WEB-applications in the signature list it generates every month a lot of false positive alerts. I'm able to disable specific revision of signatures ...
Dear community,we have recently noticed several false positives on our IPS based on Firepower Managment Center, in particular signatures: MALWARE-OTHER Win.Trojan.FANCYBEAR variant binary download attempt (1:56933:1)MALWARE-OTHER Win.Malware.Ursu-982...
Hello,I noticed in the FMC regarding IPS each discovered host have their profile that include recent scan, open ports and OS.The OS can be set manually by a list of vendors and technologies, why the list is missing Citrix? I guess there might be a fe...
Hello community,I have a simple problem using signatures updates in IPS policy. Each update bring new signatures obviously but also a lot of false positives for us. The idea is, I have alerts for "D-Link" signatures, I don't want to see anymore those...
Hello!
I'm using Sourcefire IPS and I'm reviewing the signature alerts... I scheduled a report that show me which specific snort signature triggered in a specific time frame, something like:
SIGNATURE NAME , NUMBER OF EVENTS, SEVERITY
Because w...
Thank you for feedback, so there is no way to limit signatures, unless disabling the category itself on an upper layer? Is there a description how the signatures layers and firepower reccomendations works toghether? Thanks!
