Configuring The Dragon Filter Module - Enterasys Intrusion Prevention System Manual

Configuring the Dragon Filter Module

3. Click the DoS Check Module in the tree. The DoS Check settings are displayed.
4. Denial of Service checking is enabled by default. To disable it, deselect the Enable Denial of
Service Check checkbox.
5. It is not recommended that you Enable Denial of Service Debugging unless requested to do
so by Enterasys Technical Support. When enabled, debugging information is logged in the
NetworkSensor.log.
6. Click Commit to add your changes to the policy being configured.

Configuring the Dragon Filter Module

You can use the Dragon Filter module to reduce the number of event false positives being reported
by Enterasys IPS. Events generated by signatures, or internal events generated by network sensor
policy settings, can be eliminated based on a combination of source and destination IP addresses,
IP protocol, source and destination TCP/UDP ports, or ICMP type.
Dragon filters are applied after data has been inspected, unlike Application filters that are applied
before data has been inspected. Therefore, Dragon Filter statements could be considered more
CPU intensive, in the sense that they can only be applied after the pattern matching operations are
completed. However, since both Dragon Filters and Application Filters are fairly quick operations,
neither greatly impacts the sensor's performance (unless there are hundreds of them).
Before writing a Dragon filter, you will use the Enterasys IPS reporting tools to analyze the types
of events being generated and to identify the events that should be filtered. For example, if you
have an administration computer that uses SSH to login to other computers, you will see a large
number of SSH events involving the administration computer being generated. Since these events
can safely be ignored, you can write a filter for the relevant SSH signatures to ignore them.
From analyzing the SSH events reported, you may determine that both SSH version 1 and 2
protocols are used from the administration computer's IP address of 10.10.100.100. You would
then write two filters, one for the event SSH:VERSION-1 and another for SSH:VERSION-2, each of
which would filter the event if the IP address 10.10.100.100 is either the source or destination IP
address of the traffic.
2-24 Creating Network Sensor Policies