IDS: At What Severity Level Does Blocking Occur?

[tscislaw_2]

When one configures blocking on an IDS 4210 v3.1, what severity level triggers the block?

I assume HIGH, but one must never assume.

In IDM, I haven't seen anywhere to configure this.

[pdentico · Accepted solution]

It's not based on the severity. You can use the block feature on a low priority alarm if you want to. You need to set it at the signature level. When you enable a signature and set its priority you also set the signature action, which includes the block function.

Hope that helps.

[tscislaw_2]

>>...You need to set it at the signature level...<<

Ah yes, I see that now. I hadn't delved far enough into IDM yet.

That brings up another question: Must I configure blocking for each individual signature or can I do it for groups?

A quick glance looks like I must go through each signature and select this.

Thanks for your help.

Tony

[pdentico · Accepted solution]

I haven't seen a way to group them. I've been doing it individually.

Pete

[tscislaw_2]

Bummer...

Well, I get paid by the hour so...

Tony