Enhanced SmartBlocking

When IP Reputation is enabled, the Sensor uses the reputation of the source host as an additional factor for blocking which in turn enhances SmartBlocking.

Each attack has a signature set which is in turn associated with a confidence level. Confidence level and reputation score together play the role in Smartblocking an attack. An attack is Smartblocked only when the sum total of the confidence level and the reputation score becomes 6.

Risk levels of the hosts:

Host is considered malicious— +2 increase in confidence level
Host is considered of medium risk— +1 increase in confidence level

Note

Only attacks marked for Smartblocking are considered for IP reputation scores and thus only those attacks are SmartBlocked.

Note

The reputation score is used along with Benign Trigger Probability to increase the confidence level and make a blocking decision.

New IPS attack definitions are also added for High Risk hosts. This allows you to block/quarantine a host outright if it is a high risk.

This will only happen if :

The attack definitions are included in the IPS Policy for the interface or sub-interface level.
GTI is enabled for the interface and sub-interface level.

To optimize performance, you can place certain trusted IP addresses/networks under an exclusion list. The number of entries you can exclude per Sensor are:

Sensor model	Number of exclusion list entries permitted
NS9600 stack (2-node) - 120 Gbps throughput	512
NS9600 standalone - 60 Gbps throughput	512
NS9600 standalone - 40 Gbps throughput	512
NS9600 standalone - 20 Gbps throughput	512
NS9500 stack - 100 Gbps throughput	128
NS9500 stack - 60 Gbps throughput	128
NS9500 stack - 40 Gbps throughput	128
NS9500 standalone - 30 Gbps throughput	128
NS9500 standalone - 20 Gbps throughput	128
NS9500 standalone - 10 Gbps throughput	128
NS9300, NS9200, NS9100	128
NS7600 - 20 Gbps throughput	512
NS7600 - 15 Gbps throughput	512
NS7600 - 10 Gbps throughput	512
NS7600 - 5 Gbps throughput	512
NS7500 - 7.5 Gbps throughput	128
NS7500 - 5 Gbps throughput	128
NS7500 - 3 Gbps throughput	128
NS7300, NS7200, NS7100	128
NS5200, NS5100	64
NS3600 - 5 Gbps throughput	512
NS3600 - 3 Gbps throughput	512
NS3600 - 1 Gbps throughput	512
NS3500	32
NS3200, NS3100	32

Refer to Trellix Intrusion Prevention System Product Guide for more details.