Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 330 / 861

329 Preventing attacks
Blocking suspicious or malicious traffic with IDS
Related information
For further information related to this topic, see the following:
■
“IDS Event Type Properties dialog box—General tab” on page 643
Modifying event log and block settings
An intrusion signature has a number of properties such as severity, reliability, and description. You
can only modify the log and block settings. The default values of the log and block settings are based on
the severity and reliability settings of the signature.
You can modify the log and block settings in three configurations:
■
You can enable both logging of events and blocking traffic. Note that blocked traffic is always
logged.
■
You can enable only logging of events. Note that you cannot enable only blocking traffic.
■
You can disable both logging of events and blocking traffic.
Any modifications you make apply only to the settings for the IDS/IPS policy that you have selected. If
you modify a default policy, performing a LiveUpdate resets the logging and blocking settings to the
default settings for the updated signatures.
You can modify event log and block settings in the tabular format or the tree format.
Modifying event settings in the tabular format
In the tabular format, you can modify individual intrusion events in the IDS Event Type Properties
dialog box or directly from the table. From the properties dialog box, you can review additional
information before modifying event settings. If you do not need to review the additional information
provided in the properties dialog box, you can modify event settings directly from the table.
Prerequisites
None.
Modify event settings in the tabular format
To modify event settings, do one of the following:
■
Modify settings in the table
■
Modify settings using the IDS Event Type Properties dialog box
To modify event settings from the table
1
In the SGMI, in the left pane, under Policy, click IDS/IPS .
2 In the right pane, on the Configuration tab, next to View, click Table .
3 In the Policy name drop-down list, select an IDS/IPS policy.
4 Select the intrusion event that you want to configure, and do one of the following:
■
To enable logging and traffic blocking of this event, check Log .
To enable traffic blocking, check Block .
■
To enable only logging of this event, check Log .
■
To disable event logging and traffic blocking, uncheck Log and Block .
5
Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .