Configuration: Network IDS Tab

The Network IDS tab allows configuration of the network intrusion detection system in the Alert Logic® console.

Policies

Protected Hosts

The protected hosts policy allows you to configure how the traffic is sent from the protected host to the Alert Logic Threat Manager appliance. You have the ability to enable encryption of the traffic prior to being transported for analysis.

Assignment

Assignment policies are used for specifying what IDS appliance a protected host sends the traffic to for analysis. More than one appliance can be added to a policy for redundancy.

In a dynamic environment where IP addresses often change, an assignment policy ensures that hosts always correspond to their appliances.

For more information, refer to our Assignment Policies help documentation.

Certificates and Keys

The Alert Logic SSL Decryptor extends the advanced intrusion detection capabilities of the intrusion detection system (IDS). The decryptor allows the appliance to inspect the encrypted SSL traffic.

If you use Secure Sockets Layer (SSL) communication, you can upload your SSL certificate and corresponding key. This action allows the SSL decryptor to decrypt traffic for further analysis. They will automatically assign to your IDS appliances after being uploaded.

For more information, refer to our Alert Logic SSL Decryptor help documentation.

Alert Rules

You can create a collection alert rule in the Alert Logic console to be alerted when your agent or appliance stops collecting, stops sending traffic, or when your appliance policy breaks.

For more information, refer to our Alert Rule help documentation.

Blocking Configuration

Blocking is a feature used within the IDS to prevent an attacker from accessing a host via a specific port, signature type, or host on a firewall. With IDS blocking, a block is only issued after a threat event has been recognized.

A shun command will be issued to the configured firewall. After the allotted time,  Alert Logic Threat Manager™ will then log back in and issue a no-shun command.

An event-based block is triggered when a particular event is generated. It will be possible for a block to be issued and an incident created for the same traffic.

For more information, visit our Blocking knowledge base article.

Browse Devices

A zone is a set of one or more host groups. Alert Logic creates default zones for your account based on your initial configuration discussions. You can add and modify zones to logically group hosts and apply policies in your environment. You can also use zones to limit the information users can view. Zones restrict the collected data that a user account can view. In IDS, the restricted collected data are events. In log, the restricted collected data are log messages.

A host group is a set of one or more hosts. You identify which zone contains the host group and the importance (criticality) of hosts in that host group. You also specify whether assets in that host group contain financial or medical information.