IPS alerts - Have I to be concerned?

Question

Hi, 
 
 since I am using XG, I'am getting always IPS alerts, and I am concerned about, because I don't know the reason of these alerts. 
 Are IPS alerts a alert about accessing websites with vulnerabilities or outdated software, or means an IPS alert, that my Network is attacked? 
 Here are some IPS alerts, wich I always get:

Have I to be concerned about these alerts, or is it "normal" to get everyday IPS alerts? 
 
 Regards Meghan

P.S. I am using lantowan_general IPS policy of XG

RichardHill · Accepted Answer

Hi Meghan, 
 What you're about to embark upon is a process known as "IPS Tuning". 
 This requires a fair amount of research on your part, but it's something that is extremely worthwhile and rewarding. 
 1. First off, one of the best pieces of advice that I can offer is "get to know your network". 
 
 Make a list of all of the devices in the network. 
 Write down what services are running on them. 
 Are any of these devices internet facing? If so, write down which ports they use. 
 Write down version and patching numbers - keep this list up-to-date. 
 
 Now you have this list you should begin to understand what's on your network a bit better. 
 2. Secondly, what you need to do is start looking at IPS rules that are not relevant to your estate. Some examples of obvious false positives using the above collected information: 
 
 If the IPS has a rule that looks for a vulnerability in an Apache web server, but you don't have any Apache web servers installed on your estate, you should go and turn them off. 
 Another example is that, if a vulnerability affects Windows XP, but you only have Windows 10 devices, then these can also be filtered out. 
 If the vulnerability is from January 2017, but you patched the affected software to the latest version in July 2017, then these can also be filtered out. This one is a bit more complicated because you have to ensure that the vulnerability has been patched. You can generally find this out by researching the vulnerability and reading release notes for patches. 
 
 What is important, however, is to ensure that you keep a list of rules that you've turned off in case that you decide to install a service later on. 
 This now allows you to only have IPS alerts that affect your estate. 
 3. Investigating these alerts to find out if they have affected systems is another level of complexity entirely, but I will endeavor to help you if I have the time. For this you need to be capturing the packets across the network and using log data for analysis. If you have the time and experience I would recommend building a server and implementing some form of SIEM tool. I can recommend OSSIM as a free tool for this. What this will do, in its basic form, is collect all of the log data from all of your devices on the network. This makes searching for information or evidence of vulnerability exploitation much easier because it all happens in the same place. More advanced uses include writing correlation rules and real-time monitoring, but for now getting your logs centralised into one place will be really useful. 
 4. So for your question above, what is "victim" address? What services are installed on it? Does it have a HTTP server installed? Also, I've noticed a lot of people redacting information such as IP addresses on this page and I'm not really sure why. 192.168 addresses are private addresses and so can't be accessed across the internet. The one IP that you do want to redact is your public-facing IP address - as in what IP your ISP has issued you. 
 Anyway, I hope I've helped!

lferrara · Answer

Meghan, 
 click on the attack and you will find the source and destination IP, port used. Take note you cannot edit built-in IPS profiles, so clone it and remove the false-positive signature. 
 Regards