Skip to content

Network Intrusion (IDS/IPS)

Network Intrusion Profiles are a collect of Intrusion Detection and Protection (IDS/IPS) Rules that can be used to evaluate transactions to ensure the traffic is not malicious.

Valtix supports the following IDS/IPS Rule Sets:

Rule Sets Description
Talos Rules The Talos Rules are a premium set of Rules from Cisco based on intelligence gathered from real-world investigations, penetration tests and research that provide an advanced level of protection for applications and frameworks
Custom Rules The Custom Rules are a particular set of Rules written by customers that provide a specialized level of protection for custom applications

Custom Rules

A Custom Rules Ruleset containing one or more Rules can be uploaded and used by the Valtix IDS/IPS security engine. The Rules contained within the Ruleset provide specialized application evaluations required by a customer for their specific applications and frameworks. The Custom Rules included in the IDS/IPS Profile will be evaluated first before evaluating any other Rulesets configured in the IDS/IPS Profile.

When uploading a Custom Rules Ruleset, the file should be a Gzip compressed TAR file with extension tar.gz. The compressed TAR file will consist of the following files:

  • Readme File - File that gives a description of the Ruleset
  • Changelog File - File that represents the change history
  • Rules Folder - Folder that consists of one or more ModSecurity formatted Rules files. Each file must have an extension .conf. The folder must contain at least one Rule file (cannot be empty). Each file must follow the ModSecurity Rules format guidelines.

Upload Custom IDS/IPS Rules

  1. Navigate to Manage -> Threat Research -> Network Intrusion
  2. Click the Custom tab
  3. Click the Import button and upload the Custom Rules Ruleset file

Create IDS/IPS Profile

  1. Navigate to Manage -> Profiles -> Network Threats
  2. Click Create Intrusion Profile -> Network Intrusion

General Settings

  1. Specify a Profile Name and Description
  2. Specify the Action
  3. Rule Default - Allow or Deny the requests based on the action specified in each triggered Rule and log an Event
  4. Allow Log - Allow the requests and log an event
  5. Allow No Log - Allow the requests and do not log an event
  6. Deny Log - Deny the requests and log an event
  7. Deny No Log - Deny the requests and do not log an event
  8. Specify whether to generate a Threat PCAP file if the IDS/IPS Profile detects malicious activity

Rule Sets

Tech Notes

At least one Ruleset from a Rules library (Talos, Custom) is required to be specified in the IDS/IPS Profile.

If Talos Rules and Custom Rules Rulesets are used, at least one of the two must be enabled.

If the desire is to disable the entire IDS/IPS Profile, remove the IDS/IPS Profile from any Policy Ruleset Rules so the IDS/IPS Profile will not be evaluated.

Talos Rules
  1. Specify Disabled, Manual or Automatic*
  2. Disabled - Specify whether to disable the use of Talos Rules (see Tech Notes above)
  3. Manual - Specify the Talos Rules Version to use
  4. Automatic - Specify the number of days from publish date to delay automatic update to the latest Talos Rules version
  5. Add specific Talos Rules Rulesets to the IDS/IPS Profile
Custom Rules
  1. Specify Disabled, Manual or Automatic*
  2. Disabled - Specify whether to disable the use of Custom Rules (see Tech Notes above)
  3. Manual - Specify the Custom Rules Version to use
  4. Automatic - Specify the number of days from publish date to delay automatic update to the latest Custom Rules version
  5. Add specific Custom Rules Rulesets to the IDS/IPS Profile

Advanced Settings

Rule Suppression

Rules can be suppressed for a specific IP or a list of CIDRs

  1. Click Advanced Settings tab
  2. Under Rule Suppression click Add
  3. For Source IP/CIDR List, provide a comma-separated list of IPs or CIDRs
  4. For Rule ID List, provide a comma-separated list of Rule IDs
  5. For Action, provide a selection, but this selection does not apply since a Rule being Suppressed will not be evaluated

Event Filtering

To reduce the number of security Events that are generated when the IDS/IPS Profile is triggered, the Event Filtering can be configured to rate limit or sample the Events. The configuration does not alter the detection or protection behavior.

When specifying Type as Rate, the generated Events are rate limited based on the specified Number of Events triggered over a Time evaluation interval (in seconds). For example, if Number of Events is specified as 50 and Time is specified as 5 seconds, only 10 Events per second will be generated.

When specifying Type as Sample, the generated Events are sampled based on the specified Number of Events. For example, if Number of Events is specified as 10, only 1 Event will be generated for every 10 Events triggered.

Profile Event Filtering

Profile Event Filtering applies to all Rules that are configured in the IDS/IPS Profile

  1. Specify the Type as Rate or Sample
  2. Rate - Specify the Number of Events and the Time evaluation interval (in seconds)
  3. Sample - Specify the Number of Events
Rule Event Filtering

Rule Event Filtering applies to specific Rules that are configured in the IDS/IPS Profile

  1. Click Add under Rule Event Filtering
  2. For Rule ID List, specify a comma-separated list of Rule IDs
  3. Specify Type as Rate or Sample
  4. Rate - Specify the Number of Events and the Time evaluation interval (in seconds)
  5. Sample - Specify the Number of Events

Associate the Profile

Check this document to create/edit rules