How to add an exempt rule from a log entry

deanooo

Newbie

Posts: 1

How to add an exempt rule from a log entry

« on: February 15, 2010, 08:53:00 AM »

I want to add exempt rules from false positives I have found in the logs.

I understand you can right click on the log and click 'Exempt...'
But this only works for about the last 5 log entries, anything higher, the 'exempt...' option is not there.

I can't seem to find any pattern other than being the last 5 log entries.

Thanks


	Logged

Volcanoman

Jr. Member

Posts: 50

Re: How to add an exempt rule from a log entry

« Reply #1 on: March 02, 2010, 05:30:47 AM »

Hi, you should be able to create exempt rules from any log entry. You may be observing a bug?

One thing to check is that you are clicking on the correct part of the entry. I think on certain older versions you had to right click on a certain field on the log entry to get the option. Also check you are in the top level of the log viewing tree rather than a defined view.

If all of that doesn't work you have a problem that would require a call to JTAC.


	Logged

Volcanoman

Jr. Member

Posts: 50

Re: How to add an exempt rule from a log entry

« Reply #2 on: May 14, 2010, 03:25:22 AM »

To confirm, in NSM2010 I can click on any column on any entry (even the oldest) and the exempt option appears. This has changed over the versions.

One thing to check, if a signature was deleted during a recent update (occasionally happens when they modify an attack), you would not be able to create an exempt perhaps because the attack object doesn't exist in database.

Even with the early versions of NSM you should be able to create exempt rulebase from any log entry so long as all the elements of that entry exist in the database.


	Logged

Pages: [1]

JuniperForum.com > Security > IDP > Topic: How to add an exempt rule from a log entry

« previous next »

Latest Knowledgebase Articles

Navigation

Donate

Tools

Recent

Stats

Members

Stats

Users Online