IPS policy configuration summary

The IPS Policy Configuration Summary report provides a high-level view of active IPS policies.

You can request the report to be output as a PDF file or as a CSV file in the /data/reports folder on the local drive. The format of the report file name is ips_policy_configuration_summary_hostName_dateCreated_timeCreated, where hostName is the host name assigned to your appliance, and dateCreated and timeCreated identify the date and time the report was created.

The report contains the following sections for each active monitoring interface:

At the top of the report, two colored boxes identify the active IPS policies by monitoring interface.

In the following example, the platform has one monitoring interface and the default IPS policy Comprehensive is active on the interface:

In the following example, the platform has two monitoring interfaces and the custom IPS policies a_policy and b_policy are active on the interfaces:

The first interface-specific section of the report displays two colored boxes:

In the following example, the IPS policy applied to the monitoring interface matches 1199 IPS rules in the appliance database. If the IPS policy is configured with IPS rule exclusion attributes, none of those attributes affect the matched IPS rules, because the number of Rules Excluded is 0.

For each active monitoring interface, the second section of the report breaks down the active rules (but not the excluded rules) into the following statistics:

Protocol

Number of IPS rules that cover vulnerabilities in each protocol, such as HTTP, NetBIOS, POP3, DNS, DHCP, and Telnet. For more information, see the Rule Match Attributes section in Attributes of IPS policies.

Attack target

Number of IPS rules that cover vulnerabilities related to each target host type, such as client, server, or client or server. For more information, see the Rule Match Attributes section in Attributes of IPS policies.

Threat category

Number of IPS rules that cover vulnerabilities within each supported threat category, such as denial_of_service, exploit, and other. For more information, see the Rule Match Attributes section in Attributes of IPS policies.

Number of IPS rules by threat severity level

Number of IPS rules that cover vulnerabilities within each supported threat severity range: Critical (7 ‑ 10); Major (4 ‑ 6); Minor (1 ‑ 3). For more information, see the Rule Match Attributes section Attributes of IPS policies.

IPS policy match attributes

Lists each match attribute specified in the IPS policy. For more information, see the Rule Match Attributes section in Attributes of IPS policies.

In the following example, a custom IPS policy specifies match criteria for the exploit threat category, for the HTTP protocol, for both the client and server as attack targets, and minimum and maximum severity levels 1 and 10.