Exporting Alert Filters; Importing Alert Filters - McAfee M-1250 - Network Security Platform Configuration Manual

McAfee® Network Security Platform 5.1
4
5

Exporting Alert Filters

To export alert filters, do the following:
1
2
3

Importing alert filters

You can import files containing Alert Filters into the Manager server.
To import an Alert Filters file, do the following:
1
2
3
4
5
Select the drop-down list at the top right corner of
Attack Category
page. You can filter the list of attacks based on the following criteria:
To view all the attacks, select
a.
View attacks recommended for blocking by McAfee by selecting
b.
Recommended by McAfee for Blocking
To view the attacks that are eligible for IPS Quarantine, select
c.
Quarantine.
For more information on IPS Quarantine, see IPS Quarantine settings
(on page 108).
Search for attacks using the attack name, name of impacted applications,
d.
reference ID such as CVE or BugTraq, or new attacks, by selecting
Search
option.
Select an attack, and click
Configure Alert Filter Association for Attack
The
available and selected alert filters, the type - IPv4 or IPv6 and the no. of IP address
associated with the attack.
Note: You can also use the
Configure Alert Filter Association for Attack Category
Done
Click , to save the changes.
IPS Settings > Alert Filters > Export
Select
Select one or more filters you want to export.
Export.
Click You are then prompted to
Cancel
or the request.
IPS Settings > Alert Filters > Import.
Select
Indicate whether to skip duplicate filter definitions by selecting the check box.
Otherwise, leave the field unchecked.
Browse
Click .
Select a file to import. Network Security Platform prompts you for the file name.
Apply
Click to accept the imported file for Alert Filters.
Configure Alert Filter Association for
All Selected Attacks
.
.
View/Edit
.
page opens. This page displays the
Bulk Edit
option, to edit more than one attack in the
page.
Export Alert Filter to a File
. The
Save
the filters to an XML file,
84
Managing IPS settings
Attacks
Attacks Eligible for IPS
Advanced
window displays.
Open
the filter(s),