Configuring Responses for Open Signatures

You can change the way the appliance responds to Open Signature events by setting parameters to configure response types.

About this task

Navigating in Proventia® Manager: Secure Protection Settings > Advanced IPS > Tuning Parameters

Navigating in SiteProtector Management: select the Tuning Parameters policy

When an appliance detects an Open Signature event that matches the rules you have specified, it uses the default response DISPLAY:WithoutRaw. When an event occurs, this response logs a summary event to the monitoring console. To change the default responses for Open Signatures, use the parameters in this topic.
Note: The appliance does not support configuring different responses for each Open Signature event.
Procedure
  1. Click the Add icon.
  2. Set the following Open Signature response parameters, as appropriate:
    Name Type Default Value Description
    np.opensignature.user.response String DISPLAY:WithoutRaw

    Defines the notification responses for trons rules.

    Valid notification responses are:
    • DISPLAY
    • SNMP
    • EMAIL
    • LOGEVIDENCE
    • User specified
    Example: np.opensignature.user.response=DISPLAY:WithouRaw,EMAIL:<myEmail>
    np.opensignature.response String None

    Defines the protection responses for trons rules.

    Valid protection responses are:
    • block
    • quarantine-traffic
    Example: np.opensignature.response=block
    np.opensignature.quarantine.rule String None

    Defines the quarantine parameters for the quarantine response. This is only valid if the quarantine-traffic response is defined as part of the np.opensignature.response parameter.

    Valid quarantine rule parameters are:
    • quarantine-victim-address
    • quarantine-victim-port
    • quarantine-intruder-address
    • quarantine-intruder-port
    • quarantine-icmp-code
    • quarantine-icmp-type
    Example:
    • np.opensignature.response=quarantinetraffic
    • np.opensignature.quarantine.rule=quarantine-victim-address,quarantine-victim-port