Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

How do I edit a filter on the SMS?

    • Updated:
    • 20 Sep 2017
    • Product/Version:
    • TippingPoint SMS All
    • TippingPoint Virtual SMS
    • Platform:
Summary
You can tune filters to meet the needs of your enterprise. You can modify a filter or add an exception to a filter. You can also alter the system response to an attack filter by editing the action set, changing how or when contacts are notified, or even disabling the filter.
Details
Public

Procedure:

Note: If a filter has inherited settings and the base filter is locked, the filter with inherited settings CANNOT be edited.

  1. Log in to the SMS from a client.
  2. From the top navigation pane, click Profiles. The Profiles screen displays.
  3. From the navigation pane on the left, click the + sign next to the Profiles to expand the category.
  4. From the navigation pane on the left, click the + sign next to the Inspection Profiles to expand the category.
  5. From the navigation pane on the left, locate and expand the Profile you will be working with.
  6. Click Search, and enter the required information to locate the filter you want to edit.
  7. To access the Edit Filter Wizard, select a filter and do one of the following:
    • Click Edit.
    • On the Menu Bar, click Edit > Details > Filter.
    • Double-click the filter.
    • Right-click the filter and choose Edit.
  8. To lock the filter, select the Locked checkbox.
  9. To use inherited settings, select the Use Inherited Settings checkbox. Note: This option is only available if the filter has been inherited from another Profile.
  10. In the Action area you can choose to:
    • Use Category Settings to use the recommended action setting for the selected filter.
    • Use Filter Specific Settings to customize the action setting for the selected filter.
      • For State, click the Enabled check box. If you do not click this check box, the filter custom settings are disabled.
      • From the Action Set drop-down menu, select an action set.
  11. In the General Settings area, you can choose to:
    • Use Adaptive Configuration Settings to apply the global adaptive filter settings for flow control.
      • To add AFC settings, select the checkbox.
      • To remove any global adaptive filter settings for this filter, deselect the checkbox.
    • Comments – Enter or change filter comments
  12. Trigger Criteria - Change trigger criteria settings. Note: this option is only available if the filters support this option.
  13. To create a custom filter exception, click Add in the Exceptions area.
    • Enter a Name for the exception.
    • For the Src IP Address, enter an IP address. Select the format for the address: CIDR, IP Mask, or Any IP.
    • For the Dest IP Address, enter an IP address. Select the format for the address: CIDR, IP Mask, or Any IP.
    • Click OK.
  14. To view the details for the selected filter, select Filter Details from the left navigational menu. The Filter Details screen displays information about the filter, such as Protocol, Recommended Action, and Description.
  15. In the Filters Details screen:
    • Click the CVE:id link to go to the Common Vulnerabilities and Exposures web site.
    • Click the Filter Info link for ThreatLinQ information on the TMC.
  16. If you want to distribute the newly-edited filter, click Distribute.
  17. Click OK.

 

Reference: SMS User Guide

Premium
Internal
Rating:
Category:
Configure; Troubleshoot; Deploy
Solution Id:
TP000090604
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.