Whitelisting files detected by signatures

[ihoratos]

Hello, we are experiencing high volumes of alerts from the IPS detecting :

netbios-ss: executable file upload to admin share   

triggering on ".exe."

There are many legitimate reasons to transfer .exe files between hosts and this signature is creating a lot of noise. We do not wish to disable this signature because we deem it useful..

Is there a way to whitelist certain files that are legitimate for this rule in the IPS.

tia

[fkazi04]

Hi @ihoratos 

If the traffic is trusted, you may create an Ignore rule based on the Signature name and IP addresses.

https://docs.mcafee.com/bundle/network-security-platform-9.2.x-product-guide/page/GUID-0A1726E6-28DE...

[ihoratos]

Sadly, the traffic is very heave with legitimate packets. We cannot add in the IP since there are so many and they change - DHCP.

Thank you for your response.