Intrusion Prevention - Revision history

Græmer: /* About Intrusion Prevention */

2023-02-02T16:50:05Z

About Intrusion Prevention

← Older revision		Revision as of 16:50, 2 February 2023
Line 33:		Line 33:

	To detect malicious activity, Intrusion Prevention uses ''signatures'', a method that draws upon a database of known attack patterns.		To detect malicious activity, Intrusion Prevention uses ''signatures'', a method that draws upon a database of known attack patterns.
	If a ~~network [http://en.wikipedia.org/wiki/Session_%28computer_science%29~~ session] matches a signature, its enabled ''action'' directs Intrusion Prevention to		If a session matches a signature, its enabled ''action'' directs Intrusion Prevention to
	''Log'' (records the incident but '''does not stop''' the activity) or ''Block'' (records the incident and '''does stop''' the activity).		''Log'' (records the incident but '''does not stop''' the activity) or ''Block'' (records the incident and '''does stop''' the activity).

	There is tremendous diversity between networks and it is possible for a signature to correctly identify malicious activity on one network and incorrectly match legitimate traffic on another.		There is tremendous diversity between networks and it is possible for a signature to correctly identify malicious activity on one network and incorrectly match legitimate traffic on another. Logging all matching signatures can make it difficult to effectively monitor Intrusion Prevention, and blocking can disrupt legitimate traffic, causing your network to ''appear'' to be broken. Therefore, it is perfectly legitimate for there to be many signatures set as ''disabled'' or not active in Intrusion Prevention. In fact, it is advised that you use to the ''Recommended'' actions as specified by the signature database providers.
	Logging all matching signatures can make it difficult to effectively monitor Intrusion Prevention and blocking can disrupt legitimate traffic causing ~~cause~~ your network to appear to be broken.
	Therefore it is perfectly legitimate for there to be many signatures set as ''disabled'' or not active in Intrusion Prevention.
	In fact, it is advised that you use to the ''Recommended'' actions as specified by the signature database providers.

	The database contains over 26,000 signatures making it difficult to manage signatures directly.		The database contains over 40,000 signatures, making it difficult to manage signatures directly.
	''Rules'' are used to configure groups of signatures on matching various attributes.		''Rules'' are used to configure groups of signatures on matching various attributes.
	A condition can match an attribute such as classtype. For all signatures that match, they are configured in Intrusion Prevention according to the rule action.		A condition can match an attribute such as classtype. For all signatures that match, they are configured in Intrusion Prevention according to the rule action.

Græmer: /* When To Scan */

2022-05-03T18:40:00Z

When To Scan

← Older revision		Revision as of 18:40, 3 May 2022
Line 63:		Line 63:
	When Before other Network Processing is selected (the default), IPS sees all traffic even if it will subsequently be dropped by the firewall. This means IPS will see much malicious activity like port scan, intrusion attempts on the public IP addresses that happen on almost all networks, even though that traffic will ultimately just be dropped. The advantage of this approach is that Intrusion Prevention sees and logs everything providing the most complete picture. The disadvantage is that it usually logs so much that the Intrusion Prevention event log quickly become ignored because its logging thousands of events per day and this is completely normal and expected.		When Before other Network Processing is selected (the default), IPS sees all traffic even if it will subsequently be dropped by the firewall. This means IPS will see much malicious activity like port scan, intrusion attempts on the public IP addresses that happen on almost all networks, even though that traffic will ultimately just be dropped. The advantage of this approach is that Intrusion Prevention sees and logs everything providing the most complete picture. The disadvantage is that it usually logs so much that the Intrusion Prevention event log quickly become ignored because its logging thousands of events per day and this is completely normal and expected.

	When After other Network Processing is selected IPS will only scan traffic that will actually pass through the firewall. Most networks where ~~Untangle~~ is running with a Public IP and doing NAT and only port forwarding select or no traffic at all, this will be extremely different that scanning "prerouting". The advantage of this mode is that IPS will only scan/log on traffic that is actually entering your network and therefore ignores a lot of the standard "noise" from incoming port scans and vulnerability scans that just get dropped at the firewall and logs only on traffic that should potentially concern the administrator. Another advantage is that it fully allows bypass traffic to work as expected. The disadvantage of this mode is that it provides a less complete picture of activity on the public interface it now no longer logs attempts that just get dropped.		When After other Network Processing is selected IPS will only scan traffic that will actually pass through the firewall. Most networks where NG Firewall is running with a Public IP and doing NAT and only port forwarding select or no traffic at all, this will be extremely different that scanning "prerouting". The advantage of this mode is that IPS will only scan/log on traffic that is actually entering your network and therefore ignores a lot of the standard "noise" from incoming port scans and vulnerability scans that just get dropped at the firewall and logs only on traffic that should potentially concern the administrator. Another advantage is that it fully allows bypass traffic to work as expected. The disadvantage of this mode is that it provides a less complete picture of activity on the public interface it now no longer logs attempts that just get dropped.

	=== Status ===		=== Status ===

Bcarmichael: /* Variables */

2020-02-18T21:42:39Z

Variables

← Older revision		Revision as of 21:42, 18 February 2020
Line 228:		Line 228:

	{{AppScreenshot\|intrusion-prevention\|variables}}		{{AppScreenshot\|intrusion-prevention\|variables}}

			=== Bypass Rules ===

			Bypass rules enable you to configure traffic that should not be scanned by Intrusion Prevention. The [[Rules\|Rules documentation]] describes how rules generally work and how they are configured.

			{{AppScreenshot\|intrusion-prevention\|bypass-rules}}

	== Updates ==		== Updates ==

Cblaise: /* Settings */

2019-05-15T19:33:01Z

Settings

← Older revision		Revision as of 19:33, 15 May 2019
Line 56:		Line 56:

	== Settings ==		== Settings ==

			=== When To Scan ===

			Intrusion Prevention can be run before or after other network processing. Which option depends largely on your reasons for using Intrusion Prevention.

			When Before other Network Processing is selected (the default), IPS sees all traffic even if it will subsequently be dropped by the firewall. This means IPS will see much malicious activity like port scan, intrusion attempts on the public IP addresses that happen on almost all networks, even though that traffic will ultimately just be dropped. The advantage of this approach is that Intrusion Prevention sees and logs everything providing the most complete picture. The disadvantage is that it usually logs so much that the Intrusion Prevention event log quickly become ignored because its logging thousands of events per day and this is completely normal and expected.

			When After other Network Processing is selected IPS will only scan traffic that will actually pass through the firewall. Most networks where Untangle is running with a Public IP and doing NAT and only port forwarding select or no traffic at all, this will be extremely different that scanning "prerouting". The advantage of this mode is that IPS will only scan/log on traffic that is actually entering your network and therefore ignores a lot of the standard "noise" from incoming port scans and vulnerability scans that just get dropped at the firewall and logs only on traffic that should potentially concern the administrator. Another advantage is that it fully allows bypass traffic to work as expected. The disadvantage of this mode is that it provides a less complete picture of activity on the public interface it now no longer logs attempts that just get dropped.

	=== Status ===		=== Status ===
Line 220:		Line 228:

	{{AppScreenshot\|intrusion-prevention\|variables}}		{{AppScreenshot\|intrusion-prevention\|variables}}


	== Updates ==		== Updates ==

Cblaise: /* Rule Actions */

2019-05-15T18:50:06Z

Rule Actions

← Older revision		Revision as of 18:50, 15 May 2019
Line 179:		Line 179:
	\| Disable		\| Disable
	\| Each signature will be disabled and not used by Intrusion Prevention.		\| Each signature will be disabled and not used by Intrusion Prevention.
			\|-
			\| Whitelist
			\| Each signature's Source and/or Destination networks will be modified to exclude networks defined by the selected variables.
	\|}		\|}


	=== Signatures ===		=== Signatures ===

Dmorris at 17:03, 6 May 2019

2019-05-06T17:03:06Z

← Older revision		Revision as of 17:03, 6 May 2019
Line 75:		Line 75:

	Rules allow you to control which signatures are enabled (and their actions) or disabled.		Rules allow you to control which signatures are enabled (and their actions) or disabled.
	~~Signatures~~ are ~~processed~~ in rule ~~order~~.		For each signature the rules are evaluated in order, the action from the first matching rule is used to determine the status of that signature. The Intrusion Prevention rules are the mechanism to determine which signatures are enabled and their associated actions. These rules have no impact on network traffic and are not evaluated against packets, sessions, or network traffic in any manner.
	Any signature not matched by a rule is disabled.
			Any signature not matched by any rule is disabled.

	The [[Rules\|Rules documentation]] describes how rules generally work and how they are configured. The major difference for Intrusion Prevention is the Conditions List.		The [[Rules\|Rules documentation]] describes how rules generally work and how they are configured. The major difference for Intrusion Prevention is the Conditions List.

Cblaise at 16:38, 20 November 2018

2018-11-20T16:38:18Z

← Older revision		Revision as of 16:38, 20 November 2018
Line 170:		Line 170:
	\| Each signature will be enabled to log.		\| Each signature will be enabled to log.
	\|-		\|-
	\| Enable Block if Recommended is ~~Log~~		\| Enable Block if Recommended is Enabled
	\| Only if the signature's Recommended Action is Log will the signature be configured for Block. Use this for "wide" condition matches like classtype.		\| Only if the signature's Recommended Action is Log will the signature be configured for Block. Use this for "wide" condition matches like classtype.
	\|-		\|-

Cblaise at 20:56, 13 November 2018

2018-11-13T20:56:18Z

Show changes

Dmorris at 18:16, 20 June 2018

2018-06-20T18:16:05Z

← Older revision		Revision as of 18:16, 20 June 2018
Line 8:		Line 8:
	{\| width='100%'		{\| width='100%'
	\|-		\|-
	\| align="center" \| [[Image:~~IntrusionPrevention_128x128~~.png]]     '''Intrusion Prevention'''		\| align="center" \| [[Image:IntrusionPrevention.png\|128px]]     '''Intrusion Prevention'''
	\| align="center" \|		\| align="center" \|
	{\|		{\|

Dmorris at 21:46, 14 June 2017

2017-06-14T21:46:20Z

← Older revision		Revision as of 21:46, 14 June 2017
Line 16:		Line 16:
	\|[http://www.untangle.com/store/intrusion-prevention.html Intrusion Prevention Description Page]		\|[http://www.untangle.com/store/intrusion-prevention.html Intrusion Prevention Description Page]
	\|-		\|-
	\|[http://~~www~~.untangle.com/~~store~~/intrusion-prevention~~.html~~ Intrusion Prevention ~~Screenshots~~]		\|[http://demo.untangle.com/admin/index.do#service/intrusion-prevention Intrusion Prevention Demo]
	\|-		\|-
	\|[http://forums.untangle.com/intrusion-prevention/ Intrusion Prevention Forums]		\|[http://forums.untangle.com/intrusion-prevention/ Intrusion Prevention Forums]

← Older revision		Revision as of 18:16, 20 June 2018
Line 8:		Line 8:
	{\| width='100%'		{\| width='100%'
	\|-		\|-
	\| align="center" \| [[Image:~~IntrusionPrevention_128x128~~.png]]     '''Intrusion Prevention'''		\| align="center" \| [[Image:IntrusionPrevention.png\|128px]]     '''Intrusion Prevention'''
	\| align="center" \|		\| align="center" \|
	{\|		{\|