1 Reply Latest reply on Aug 14, 2012 7:05 AM by greatscott

    HIPS 8 IPS Policies

    davsanto

      Installed Hips 8 with Agent 4.6 on various window systems (2003, Win7 , 2008 etc...)

       

      Enabled IPS signatures 6010 and 6011

       

      Created appropriate exception rules within the IPS policy

       

      On most systems HIPS 8 with blocking and excpetions rules work as expected. 

       

      On some systems it does not work

       

      Veriied HIPS 8 installed and active

       

      Verified polices are applied

       

      Reinstalled agent/hips reapplied policies on systems with issues still no change

       

      Need to determine why HIPS 8 does not work on some systems.

       

       

      Thanks

        • 1. Re: HIPS 8 IPS Policies
          greatscott

          If these are the application blocking signatures, make sure your exception paths are correct. You could have an exception as follows:

           

          Process path C:\program files\whatever.exe

           

          This could be correct for some products but maybe you have another system where your exception may not apply:

           

          Process path C:\program files (x86)\whatever.exe

           

          In this case you would need to wildcard out the C:\program files*\whatever.exe file

           

          Message was edited by: greatscott on 8/14/12 7:05:49 AM CDT