Instrusion Prevention - where to look? (MOVED too Whislist)

[Guest]

[mrt]

Hi,

Endian 2.3 have both Intrusion Detection (IDS) and Intrusion Prevention (IPS) and I could see all the detection in log.

Both there is one thing I missing from my "old" Clarconnect/ClearFondadion.

Where can I see what have been blocked and for how long time is it blocked?

My older system had one IPS function where I could see which IP that had been block, for what reason and block for 24 hour. I could also "unblock" it if it was a false rule/positive

Do Endian 2.3 have the same ?

Regards

[vlongjvc]

You can request this function in "EFW Wishlist". I see that this feature is very useful. Thanks.

[mrt]

Done

[xxxx]

This function is not very usefull because the Endian uses Snort inline this drop the bad pakets in the connection in real time not like the most Ips configs where snort detects and Guardian write the Ip to iptables drop list.The Ids/Ips from the endian is so more powerfull like the Ids from the most other Firewall Distributionen.