Write Signature Service Checkbox with airSlate SignNow

Write signature service checkbox

welcome to the getting started with intrusion prevention service video tutorial during this brief video I'll define IPS and explain how to set up and use IPS as well as how IPS and watch guard dimension work together to keep you informed about threats to your network intrusions are direct attacks on your network that usually exploit a vulnerability in an application these attacks are created to cause damage to your network get sensitive information or use your computers to attack other networks intrusion prevention service or IPS is a fully integrated security subscription for watch guard firebox and xtm devices that can help you protect your network from these types of attacks IPS works in tandem with your firebox or xtm device to provide real time protection from threats such as spyware sequel injections cross-site scripting and buffer overflows when a new attack is identified the features that make the intrusion attack unique are recorded these recorded features are known as the signature IPS uses these signatures to identify intrusion attacks IPS scans traffic on all major protocols using continually updated signatures to detect and block identified attacks because IPS is integrated with your firebox or xtm device you have an easy to manage cost-effective solution without additional hardware to purchase and maintain to configure IPS open watch card system manager and navigate to policy manager in policy manager select subscription services and then intrusion prevention like this to enable IPS select this checkbox next you need to select one of the two available scan modes with full scan mode IPS scans all packets for policies that have IPS enabled with fast scan mode IPS scans fewer packets to improve performance fast scan mode is the default setting and provides faster throughput for scan traffic but it doesn't provide the comprehensive coverage of full scan mode after selecting a scan mode you need to configure the IPS actions IPS categorizes IPS signatures in 25 threat levels based on the severity of the threat you can configure the action IPS takes for traffic that matches signatures at each threat level the allow action allows the connection drop denies the request and drops the connection without sending information to the source of the content block denies the request drops the connection and adds the IP address of the source to the blocked sites list for actions at each threat level you can also select whether IPS creates a log message or triggers an alarm by default IPS drops and logs traffic that matches signatures at the critical high medium or low threat levels traffic that matches signatures at the information threat level is allowed and not logged by default to keep things simple I'll accept the default settings when you enable IPS it's enabled for all policies by default on the policies tab IPS can be enabled or disabled for specific policies after you enable IPS it's enabled by default in any new policies you create you if you make any changes to the default settings make sure you save the configuration file to your device so the changes can take effect now that I've configured and enabled IPS I want to make sure that it protects my network from the latest threats how do I do this by enabling automatic updates for intrusion prevention signatures to configure signature update settings start by clicking here to enable automatic signature updates make sure this checkbox is selected here is where you specify the interval between automatic updates the default is one hour I like that interval so I'll leave it as it is but you can change it according to your specific needs select this checkbox to automatically update signatures at the update interval selected above the same update server settings apply to all of the signature based services gateway AV IPS application control and data loss prevention though you can independently enable automatic updates for each service don't change this URL unless you're instructed to do so by watchguard if you do happen to incorrectly or accidentally change it click the restore defaults button here if your firebox or xtm device must connect through an HTTP proxy to get the signature update server at the information about the HTTP proxy server here you just a quick reminder if you make any changes to your IPS update signature save the configuration file to your device when I PS detects content that matches an IPS signature it takes the action based on the signature threat level if the action for the threat level is set to drop or block IPS prevents the intrusion if logging is enabled you can look at the log message to see the signature ID to see the log message open the traffic monitor tab and fire box system manager here is an example of an IPS log message in the log message you can see the signature ID name severity and category to see more information about this threat you can right click the log message in firebox system manager and select lookup signature information the watchguard IPS security portal appears in a browser window with details about the signature the additional information section includes links to other information about the vulnerability if available on the IPS security portal you can also look up any IPS signature by name or ID IPS exceptions allow you to configure the fire box to use a different action to a specific signature that is currently configured for that signatures severity level if you know that a specific signature is triggered as a false positive for your environment and that signature doesn't pose a risk in other policies you can use exceptions to allow that specific signature to add an IPS exception open the IPS configuration dialog box like this when the dialog box opens click here in the signature exceptions dialog box type the signature ID and then click add you after you've added all of your exceptions you can close this dialog box by default an exception allows traffic that matches the signature but you can also add exceptions that drop or block traffic that would otherwise be allowed finally to see IPS working for you let's take a look at watchguard dimension with dimension you can prove the worth of your IPS investment to review the actions IPS is taken in watchguard dimension navigate to the services reports like this watchguard dimension includes predefined reports that are automatically generated from the log message data from your firebox or xtm device fire clusters and watch guard servers using dimension along with IPS provides you as a network administrator with full visibility of the threats that IPS has blocked for you all you need to do is make sure that you've correctly set up logging and that you've configured logging in the policies for which you've enabled IPS you can review watchguard dimension help for more information about using dimension to protect your network to learn more about IPS visit the watchguard website