Just wondering, as I did not want to just assume things, but had 2 questions as it relates to new threats/vulnerabilities and using IPS to mitigate against.
1. If an IPS profile is created via filter, will any new signature, updated from the subscription, that matches to said filter, automatically also apply? eg... if I have a filter based on macOS, is a new signature that is macOS applicable, dynamically applied as well since it is a dynamic filter (again, sounds logical, but don't want to assume)?
2. What is the normal turn-around for new vulnerabilities to then be turned around into IPS signatures from FortiGuard for the database to be updated? eg... Apple has some new vulnerabilities (CVE-2023-41064, CVE-2023-41061) that was disclosed yesterday (but CVE was created back on the 22nd of last month). FortiGuard has nothing about those on their website as of yet.
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
According to the Administrative Guide (for FortiOS 7.2.5 anyway), your assumption is correct. If you have an active IPS license, the new signatures will be automatically applied to any existing filters. Here is the excerpt:
"The FortiGuard Service periodically adds new predefined signatures to counter new threats. New predefined signatures are automatically included in IPS sensors that are configured to use filters when the new signatures match existing filter specifications. For example, if you have an IPS sensor with a filter that includes all signatures for the Windows operating system, your filter will automatically incorporate new Windows signatures that the FortiGuard Service adds to the database."
Hello, is there a way that the new vulnerabilities published on this page can reach me by email? as notification
To get PSIRT notifications:
Log into support.fortinet.com
In the top right corner, click on your name and select My Account
On the Account page, click on My Account (IAM version)
On the left side, click on Account Preferences
On the top right corner of the Account Preferences page click Edit
At the bottom, under PSIRT Contact, enter the email addresses you’d like to have notified of any future PSIRTs released (comma delimited)
Click Update in the top right corner, where you clicked Edit in step 5.
This should get you all email notifications on future PSIRTS
Thank you very much, I already added my email. So from now on, if there are new vulnerabilities in fortios or other equipment, you should receive a notification.
I appreciate and thank you for your time responding. I would like to restate and get clarification on question 1 however since I don't feel like it was confirmed as to what I was asking. The assumption to my inquiry was that of a active license for IPS signatures. What I was wanting a confirmation on, was if the sensor was built using a filter, would any new signatures applicable for said filter, be dynamically applied to the sensor (which makes logical sense) or is that sensor static at that moment in time of being built (even though a filter was used... i.e.. it made the sensor with what was available at that moment in time, but does not dynamically add new signatures that match against the filter until you refresh the sensor yourself), thus making it necessary to refresh that sensor periodically? Again, I feel like the answer logically makes sense the it is dynamically built to include all new IPS signatures as they match up, but don't want to assume, thus needing confirmation.
According to the Administrative Guide (for FortiOS 7.2.5 anyway), your assumption is correct. If you have an active IPS license, the new signatures will be automatically applied to any existing filters. Here is the excerpt:
"The FortiGuard Service periodically adds new predefined signatures to counter new threats. New predefined signatures are automatically included in IPS sensors that are configured to use filters when the new signatures match existing filter specifications. For example, if you have an IPS sensor with a filter that includes all signatures for the Windows operating system, your filter will automatically incorporate new Windows signatures that the FortiGuard Service adds to the database."
Thank you. Exactly what I was looking for.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1502 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.