Configure alert suppression with packet log response

Prerequisite: Make sure the Sensors for which you want to configure alert suppression are active and reachable to the Manager.

You can set a suppression limit for multiple occurrences of a singular attack for a specific source-destination IP address pair that is detected within a limited time frame, as well as set up packet logging for the attacks — this is known as Exploit throttling. Exploit throttling limits the number of duplicate alerts that are sent to Manager from a Sensor. Throttling is very effective against repetitive Exploit attacks where a source IP address is spoofed and generates a high number of alerts. In addition, the Sensor saves the alerts and packet logs in first-in first-out (FIFO) buffers in the event it loses communication with Manager, as well as when a Sensor generates alerts faster than it can send to Manager. The Attack Log, in its details, displays this type of alert as Exploit with an Attack Count of 2 or higher.

Note

Alert suppression is unavailable for anomaly-based buffer overflow and shellcode attacks.

In Trellix IPS, an exploit throttle alert is the grouping of multiple instances of the same attack (by Alert ID) from a single source to a single destination detected by the same VIPS (interface or subinterface — if an interface has been segmented into subinterfaces, the interface is no longer the VIPS; the subinterface is). Thus, the equation is: AlertID + VIPS + Source IP + Destination IP + Count = Exploit throttle attack

The Generate unique suppression summary alerts for up to [ X ] attack, attacker and target combinations field determines the number of unique Exploit throttle instances to maintain at a given time. For example, if you enter the number 10, then 10 unique Exploit throttle instances can be tracked at a given time. Once 10 is reached, all other cases are kept in a single "wildcard" instance; thus, other unique combinations that occur outside of the 10 uniquely maintained instances are maintained as one instance, and source and destination IP addresses do not appear in the Exploit throttle summary since multiple addresses may be involved. This is due to Sensor memory limits. A throttle entry is removed after the time limit (The alert suppression window is [ X ] seconds) has expired.

The Generate standard alerts for the first [ X ] attack(s) seen during the alert suppression window identifies the minimum number of alerts that must be detected for a unique suppression instance to be classified as an exploit throttle attack. This number means you accept a specific number (x) of the same attack. Thus, if you detect x-1 by the expiration of the interval (The alert suppression window is [ X ] seconds field), alerts are sent for each separate occurrence and there is no exploit throttle. If there are x+1, the first x attacks are sent as individual alerts and the attacks exceeding this count are throttled into one alert that summarizes this persistent attack. By sending a few of the throttled alerts as individuals allows you to view details and packet log information for the first few instances of an attack.

The The alert suppression window is [ X ] seconds field is the time span in which you accumulate instances of the same attack. This value acts as a timer; when the timer expires, the current instance is cleared to make room for a new suppression instance.

The Correlate signatures for a single attack for [ X ] seconds field notes the amount of time that the Sensor will correlate the signatures used to detect a suppressed attack instance. Many attacks have multiple signatures; thus, the suppression is valid as long as any signature for a suppressed attack has detected a single attack instance. Correlation sends the signature with the lowest Benign Trigger Probability in the suppressed alert record.

Complete the following tasks to enable alert throttling.