Network Intrusion Prevention

[work]

Within the Exploit Prevention category policy for Endpoint Security Threat Prevention, there is an option called "Network Intrusion Prevention". Any one have some info on what this does? I could not find anything on it within the manual for Endpoint security.

[Former Member]

They could really do it justice if they included the option to exclude IP's / Subnets.

Enable Network Intrusion Prevention option — Enables Network Intrusion Prevention (NIPS) and enforces network IPS signatures. Selecting this option exposes Network IPS signatures in the Signatures list. Automatically block network intruders option — Blocks intruder hosts for a specified number of seconds. Select this option to block all attempted actions from intruder hosts, even if the action for the Network IPS signature isn't set to Block. • Number of seconds (1-9999) to block — 6pecifies the number of seconds to automatically block intruders. Automatically block network intruders This text will be included in the next version of the documentation.

Does that help at all? I can go into greater detail if desired. That is from their update

[mikee]

I have the same question. Anyone who knows where I could find information on this?

[Majidkhan]

Hi,

1. With this option enabled "Enable Network Intrusion Prevention" does it not reports us the intrusions detected on which specified hosts? 

2. Automatically block network intruders does that mean the affected machine where it matches the signatures would be blocked automatically till the specified time in secs. After which it will unblock that machine (release) again?

3. Network Intrusion Prevention signatures would be updated via DAT (Endpoint Security Exploit Prevention Content) every month?

[jess_arman · Accepted solution]

@Majidkhan For the answers to your questions, please review the ENS Threat Prevention Product Guide PD27574, beginning on Page 15, with the section "How Signatures Protect Applications and Systems", continuing to "How Network IPS Works".

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

[ktankink · Accepted solution]

1. Ensure that you have the Network IPS signatures set to BLOCK and/or REPORT; there are 16 NIPS signatures in the ENS Exploit Prevention policy (review the Signature list, and use the Network IPS filter).  If Network IPS signatures are triggered, ePO events will be generated for that activity.  Review the ePO Threat Event menu for NIPS events; these should be Event ID 18059 events with Event Category Host intrusion (hip.nips) values.

2. Correct.  When a NIPS signature triggers, the ENS client would automatically block all traffic from the remote IP address that triggered the signature for the specified amount of time.  The NIPS event in ePO will contain the remote IP address details as the Threat Source IP address value.

3. Network IPS signatures are provided via the monthly ENS Exploit Prevention Content updates (which are separate from Antivirus DAT content updates).  There won't necessarily be a new signature every month though; the last NIPS signature added was Sig 6119 - SMB Double Pulsar Ping, which was released Oct 2018 in the 10.6.0.8701 content.