Skip to main content
sims
sims
Explorer II
September 1, 2020
Question

Ips Action Default

  • September 1, 2020
  • 1 reply
  • 4052 views

Hi

 

 

Ips default action change from  block to monitor, why it is changing in the database also ? 

 

If I need two sensor, in one  I need to block  and the other one I need to monitor 

What is the default action in the signature database ? 

 

Thanks 

    1 reply

    Yurisk
    SuperUser
    Yurisk
    SuperUser
    September 2, 2020

    Default action of most of the signatures is PAss/Monitor, this is done by Fortinet to prevent false positives. Also, it may change per signature basis after an IPS update.

    TO control the signature action use Signature Override, which was created exactly for that, such action will not be changed by updated to IPS.

     

    yurisk.info - all things Fortinet blog, no ads
    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!