Detecting attacks | Network Intrusion Detection System (NIDS) |
|
|
Enabling and disabling NIDS attack signatures
By default, all NIDS attack signatures are enabled. You can use the NIDS signature list to disable detection of some attacks. Disabling unnecessary NIDS attack signatures can improve system performance and reduce the number of IDS log messages and alert emails that the NIDS generates. For example, the NIDS detects a large number of web server attacks. If you do not provide access to a web server behind your firewall, you might want to disable all web server attack signatures.
Note: To save your NIDS attack signature settings, Fortinet recommends that you back up your FortiGate configuration before you update the firmware and restore the saved configuration after the update.
To disable NIDS attack signatures:
1Go to NIDS > Detection > Signature List.
2Scroll down the signature list to find the signature group to disable.
Attack ID numbers and rule names in attack log messages and alert email match those in the signature group members list. You can scroll through a signature group members list to locate specific attack signatures by ID number and name.
3Uncheck the Enable check box.
4Select OK.
5Repeat steps 2 to 4 for each NIDS attack signature group that you want to disable.
Select Check All 
to enable all NIDS attack signature groups in the signature list.
Select Uncheck All 
to disable all NIDS attack signature groups in the signature list.
Adding user-defined signatures
You can create a
For information about how to write
1Go to NIDS > Detection > User Defined Signature List.
2Select Upload.
3Type the path and filename of the text file for the
4Select OK to upload the text file for the
5Select Return to display the uploaded
252 | Fortinet Inc. |