While setting up blocking criteria in attack set profile for the attacks to be automatically blocked, remember the following:
If an attack is set to be automatically blocked as per the blocking criteria set in attack set profile and the blocking action for that attack is disabled manually in Master Attack Repository, the configuration set for blocking the attack would take precedence over the Master Attack Repository. This means that the blocking action for that attack would be set to Inherit (Enable Blocking) in Sensor Actions - Response segment in IPS policy.
Important
If you wish, you can override the automatic blocking behavior of any attack by manually setting the Sensor blocking action during IPS policy configuration. Sensor response actions customized in the IPS policy always takes precedence over automatic blocking of attacks criteria set in the Attack Set Profiles page.