- Gold, 750 points or more
Is there any way to configure the IPS module on an ASA firewall to only generate alerts (first phase of deployment). I am not sure about whether setting the 'event overwrite' option to 'Alert' and setting the RR to 0-100 will do the trick. I am currently thinking to also create a copy of the sig0 signatures and changing the pre-defined actions to Alert only but of course I would rather perform the first approach - Event Overwrite - if possible.
Any input would be much appreciated !