3 Replies Latest reply on Aug 3, 2015 12:10 PM by Kary Tankink

    HIPS IPS Rules Logging

    rbkinsey

      Perhaps this is too granular but adding a column in the IPS Rules view to indicate whether a rule is logged or not.  Additionally, being able to select one or multiple rules and enable / disable logging from the primary interface instead of having to open each rule separately to ensure logging is set as desired for the specific rule(s).

        • 1. Re: HIPS IPS Rules Logging
          Kary Tankink

          Perhaps this is too granular but adding a column in the IPS Rules view to indicate whether a rule is logged or not.

          There is already a filter for this.  When modifying your IPS Rules policy, set the Log status filter to ENABLED to show which IPS signatures will generate an ePO event.

           

          Additionally, being able to select one or multiple rules and enable / disable logging from the primary interface instead of having to open each rule separately to ensure logging is set as desired for the specific rule(s).

          This already exists.  When modifying your IPS Rules policy, select the IPS signatures you want to modify, then click the EDIT MULTIPLE action item. You can enable or disable the logging status for every selected signature.

          • 2. Re: HIPS IPS Rules Logging
            rbkinsey

            Hi Kary,

             

            Yes, the filter is helpful.  The main thing we were thinking of is the main view when looking at all the rules at a time so you can see the logging status for all rules instead of having to filter.

             

            I had overlooked the EDIT MULTIPLE option - it's been there how long?

            • 3. Re: HIPS IPS Rules Logging
              Kary Tankink

              I would suggest submitting a PER to request the ability to modify the signature columns, since you can't do that in the current version.

               

              The EDIT MULTIPLE action was added in the HIPS 8.0 product and has been there since it's release in 2010.  PD22894, page 40-41.

              NOTE: You can make changes to several signatures at once, by selecting the signatures and clicking Edit Multiple. In the page that appears, select the settings for the three editable items, then click OK .