There is a little bit difficult to find an IPS manual for tuning... i'd suggest as follow:
- Be sure about FW resources as CPU & Memory consumption before enable IPS inspection. A firewall with heavy load traffic will be slow down pretty much after enalbling IPS.
- Configure signature by Severity including Critical, High, Medium modifing their default action to Monitor.
- See what's happen in Security Events inside Logs & Report section
- After a couple of week review again the logs and take a decision about what to enable in the IPS sensor.
- Do not enable signatures for targets that doesn't exist, for example.. why enable Linux signatures (to protect Linux servers) if you don't have Linux Servers.
- Make an inventory of you assets (OS, Apps, devices, etc) to be sure what is in your infrastructure.
- Remember, once IPS is enabled, the fortigate resources will consumed either in block or monitor mode.
In Reply to Alden Chevez:
Is there a manual for a proper IPS tunning? I know a proper tunning will vary on every organization, but at least some basic info would be useful