Default time for IDM to block hosts

[tcavdar]

In IDS 4.0 what is the default time for IDM to block hosts(in access-list for a router)?And this time is configurable?

[tcavdar]

I have learnt that it is 30 minutes...

How can i change it?

[stleary · Accepted solution]

From the sensor CLI:

config term

service virtual-sensor-configuration virtualSensor

tune

shunEvent

ShunTime (minutes to block hosts)

From IDM:

Click Configuration

Click Blocking

Click Blocking properties

Update the Block Time input control.

Note: This was recently added to IDM, so you may need

to upgrade to the latest IDS software.

[jlively]

note that this affects ALL signatures. When you apply it, your sensor will have to generate new cache files..so it will act just like if you tuned a sig.