Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...

You can also edit existing types from this panel. Remember that if you edit an existing Application
Type from here, the changes will be applied to all security elements making use of it.
Events
Priority: The priority level of the DPI Rule. Higher priority rules are applied before lower priority
rules.
Severity: Setting the severity of a rule has no effect on how the rule is implemented or applied.
Severity levels can be useful as a sorting criteria when viewing a list of DPI Rules. More
importantly, each severity level is associated with a severity value; this value is multiplied by a
Computer's Asset Value to determine the Ranking of an Event. (See System > System Settings
> Ranking.)
CVSS Score: A measure of the severity of the vulnerability according the National Vulnerability
Database.
Detect Only: Use this checkbox when testing new rules. By checking this box, the rule will
create a log entry prefaced with the words "detect only:" but will not interfere with traffic. Note
that if you check the "disable logging" checkbox in the next panel (below), the rule's activity will
not be logged regardless of whether "Detect Only" is checked or not.
Disable Logging: Check to disable Event logging.
o Generate Event on Packet Drop: Log the dropping/blocking of a packet.
o Generate Event on Packet Modify: Log the modification of a packet (i.e. if you are
replacing a suspicious string of bytes.)
o Always Include Packet Data: Includes the packet data in the log entry.
o Enable Debug Mode: Logs multiple packets preceding and following the packet that
triggered the rule. Trend Micro recommends only using this option if instructed to do so
by your support provider.
Identification (Displayed for downloaded rules only)
Type: Can be either Smart (one or more known and unknown (zero day) vulnerabilities), Exploit
(a specific exploit, usually signature based), or Vulnerability (a specific vulnerability for which one
or more exploits may exist).
Issued: The date the Rule was released (not downloaded).
Identifier: The rule's unique identifier tag.
Vulnerability (Displayed for downloaded rules
only)
Displays information about this particular vulnerability. When applicable, the Common Vulnerability
Scoring System (CVSS) is displayed. (For information on this scoring system, see the CVSS page at the
National Vulnerability Database.)
Configuration (Displayed for downloaded rules
only)
Configuration Options: If the downloaded rule has any configurable options, they will be
displayed here. Examples of options might be header length, allowed extensions for http, cookie
length, etc. If you apply a rule without setting a required option, an alert will be triggered telling
© Copyright 2010 Trend Micro Inc. www.trendmicro.com
All rights reserved. - 42 -