New threats and Intrusion Prevention

Question

Just wondering, as I did not want to just assume things, but had 2 questions as it relates to new threats/vulnerabilities and using IPS to mitigate against.

1. If an IPS profile is created via filter, will any new signature, updated from the subscription, that matches to said filter, automatically also apply? eg... if I have a filter based on macOS, is a new signature that is macOS applicable, dynamically applied as well since it is a dynamic filter (again, sounds logical, but don't want to assume)?

2. What is the normal turn-around for new vulnerabilities to then be turned around into IPS signatures from FortiGuard for the database to be updated? eg... Apple has some new vulnerabilities (CVE-2023-41064, CVE-2023-41061) that was disclosed yesterday (but CVE was created back on the 22nd of last month). FortiGuard has nothing about those on their website as of yet.

FortiNet_Newb · Accepted Answer

According to the Administrative Guide (for FortiOS 7.2.5 anyway), your assumption is correct. If you have an active IPS license, the new signatures will be automatically applied to any existing filters. Here is the excerpt:

"The FortiGuard Service periodically adds new predefined signatures to counter new threats. New predefined signatures are automatically included in IPS sensors that are configured to use filters when the new signatures match existing filter specifications. For example, if you have an IPS sensor with a filter that includes all signatures for the Windows operating system, your filter will automatically incorporate new Windows signatures that the FortiGuard Service adds to the database."

Raghu_Kumar · Answer

Hello @Cajuntank,   1. If you have active license for IPS, the signatures are actively updated if you have active connectivity to FortiGuard servers.   2.Once CVE is reported globally. It takes some time for PSIRT (Product Security Incident Response Team)  for an official release about the CVE. For the detail of the respective CVE, kindly be informed that the relevant will be shared via our official PSIRT announcement in short future. Please monitor this page: https://www.fortiguard.com/psirt as the respective information would be published in the respective page.

Hello @Cajuntank,

1. If you have active license for IPS, the signatures are actively updated if you have active connectivity to FortiGuard servers.

2.Once CVE is reported globally. It takes some time for PSIRT (Product Security Incident Response Team) for an official release about the CVE.

For the detail of the respective CVE, kindly be informed that the relevant will be shared via our official PSIRT announcement in short future. Please monitor this page: https://www.fortiguard.com/psirt as the respective information would be published in the respective page.

Sign up

Login with SSO

Login to the community

Login with SSO