Dynamic block rules for IPS events

Back to Gaia

The same way you can configure a rule to log, alert by mail, you can set an IPS rule to run some command. For example, block the offender (dynamic blacklist).

This will set an automatic rule (for all Security Gateways managed by this Security Management Server) with the Source IP address of the host that caused a hit on the IPS protection during 1 hour

In summary, set this action:

Run UserDefined script: sam_alert -t 3600 -I -src

Steps:

1. In SmartDashboard, go to IPS tab - click on Protections
2. Search for Host Port Scan
3. Double-click on the Host Port Scan protection
4. Double-click on the relevant IPS profile (that is assigned to the involved Security Gateway)
5. Select Override IPS Policy with - select Detect
6. In the Track field, select User Defined Alert no. 1
7. Set the desired Detection Sensitivity
8. Click on OK to apply the changes and return to SmartDashboard main window

And now configure an automatic SAM rule to close the port scanning connections:

1. In SmartDashboard, go to Policy menu - click on Global Properties...
2. Expand Log and Alerts - click on Alerts
3. Check the box Run UserDefined script (under Send user defined alert no.1 to SmartView Monitor)
4. Add an automatic SAM rule:

sam_alert -t 3600 -I -src