Hi,
I would need to include only F5 signatures in an IPS policy.
Of course, I know that they can be added individually, only then if new ones come out they won't be added automatically or am I wrong?
Is there a simple and effective way to include only F5 signatures and all new ones in case they come out?
Thank you
Hey Daniele,
I ran a quick test, and there are currently no name-based filters available in IPS sensors as far as I could determine.
-> you can't create an IPS sensor with a filter for "F5*"
-> you could create an automation stitch on the FortiGate for IPS signature update (trigger Event Log, Log ID 32110, https://docs.fortinet.com/document/fortigate/6.4.5/fortios-log-message-reference/32110/32110-log-id-upd-sign-ips-db) to send out an alert if IPS signatures were updated, and check if there are new F5 signatures and then add them manually
-> you could create a broader sensor (for target 'server', OS 'Linux', for example) that all F5 signatures should match into
Other than that, the only option would be a feature request to allow IPS sensor filters based on signature name, not just specific characteristics; you can submit a feature request via your local Sales representative.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
