To disable an attack definition:
For instructions up to this step, refer to the section Create and assign ignore rule objects.
Select the source and destination IPs and ports in the corresponding fields.
To disable an attack definition, select Any IPv4 address or Any IPv6 address and Any Port.
Tip
Since the Attack Name, Direction, Source, Source Port, Destination, and Destination Port are pre-populated with information about the alert, the only remaining steps to disable an attack definition are to choose to ignore a specific attack launched by all hosts, specify the source and destination ports, specify the scope of application of the exception, and click Save. Clicking Save will disable the attack definition.
Select the Scope of the exception.
Notice that the options for the scope of the exception will differ when you make choices as mentioned above. If you choose to disable the exception for a light-weight policy, select Interface and specify the exact interface. If you choose to disable the policy for a baseline policy, select Baseline Policy and specify the policy. If you choose to disable the exception for the entire domain, select Global.
Note
The default value will be set to Global, which will mean that the specific attack definition is disabled for the entire admin domain.
Select the checkbox to acknowledge or delete the alerts that match the above mentioned settings, if necessary.
It is not mandatory to select either of the options.
Click Save.
You will be prompted to run a configuration update for the changes to take effect.
Click Yes.
The Deploy Pending Changes window appears. Devices that lie within the purview of the scope of the exception are automatically selected. You can deselect this if you want to update the Sensor configuration later. Trellix recommends completing the Sensor configuration update.
Click Deploy.
The device configuration is updated and the attack definition is disabled as configured.