Configures an alert policy exception for an attack category that encompasses multiple alert rules or vulnerabilities.
Syntax
policymgr signature category <attackCategory> interface {<portPair> | ALL | MGMT} src {<srcIP>/<prefix> | any} dst {<dstIP>/<prefix> | any} action <actionType>
Parameters
<attackCategory>
Configure an exception for one of the following predefined attack categories:
Infection-Match—Alert rules that perform full or partial matching to identify a URL pointing to a Web infection.
Malware-Callback—Alert rules that identify callback events, which include signature matches and communications with a botnet server.
Riskware—Alert rules that identify files that are similar to malware but are not intended to be malicious.
IPS—All IPS alert rules.
Reconnaissance—IPS alert rules that detect reconnaissance activity (ping sweeps and port scans of ports, hosts, or networks) in progress and generate alerts when suspicious activity reaches a threshold.
Local-Signature—All custom alert rules, including custom IPS rules.
Domain-Match-All domain match alerts.
interface {<portPair> | ALL | MGMT}
Apply the exception to traffic through the specified appliance interface:
<portPair>—Traffic through the specified monitoring port pair. See the Hardware Administration Guide for your appliance.ALL—Traffic through all monitoring port pairs.MGMT—Traffic through the appliance management interface.
src {<srcIP>/<prefix> | any}
Apply the exception to traffic with the specified source.
<srcIP>/<prefix>—Traffic with the specified source IPv4 host or subnet, specified in CIDR format. Example:10.128.45.154/32<any>—Traffic with any source IPv4 address.
dst {<dstIP>/<prefix> | any}
Apply the exception to traffic with the specified destination.
<dstIP>/<prefix>—Traffic with the specified destination IPv4 host or subnet, specified in CIDR format. Example:172.217.27.36/32<any>—Traffic with any destination IPv4 address.
<actionType>
Take the specified action on matched traffic: Block, UnBlock, Suppress, Suppress & Unblock, or Default. For details, see "Alert Policy Exception Actions" in the Network Security User Guide.
Example
This example configures an alert policy exception for the alert rules that address aspects of the signature name Downloader.Locky. The exception applies to traffic through the appliance monitoring port pair A, with the 10.128.45.154/32 subnet source and the 172.217.27.36/32 subnet destination. For matched traffic, blocking is disabled.
hostname (config) # policymgr signature category IPS interface A src 10.128.45.154/32 dst 172.217.27.36/32 action unblock
User role
Operator or Admin
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Network Security: Release 9.0.2