Skip to main content
Juquinha
New Member
April 16, 2021
Question

IPS Block or Quarantine?

  • April 16, 2021
  • 1 reply
  • 2292 views

Hi!

 

I would like to know from you guys if there is a best-practice rule in terms of the IPS action? I am wondering if it is better to only block (and have all those signatures processed daily by the IPS engine) or quarantine the source IP for, i don't know, 1 day or something like that, to save the resources of the box and either receive  a fewer number os malicious hits.

 

Feel free to hint.

1 reply

abarushka
Staff
Staff
June 8, 2022

Hello,

 

It is hard to say which option is better. It depends on the conditions and environment.