• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

Kudos1 Stats

IPS issue

Today I was attacked by some computers. Norton blocked this attacks and in logs I found an events...

So I want to ask, why I can't find anything regarding this attacks in "Intrusion and browser protection" section in Norton Firewall settings? There is nothing about them...

Replies

Kudos0

Re: IPS issue

When an attack is detected, your Norton product automatically blocks the connection to ensure that your computer is safe. *If a computer uses a different attack signature than that used during the first attack, your Norton product activates Intrusion AutoBlock to block that computer.* Intrusion AutoBlock blocks all traffic between your computer and the attacking computer for a limited time.

https://support.norton.com/sp/en/us/norton-security-with-backup/22.8.0.50/solutions/v15911753

Kudos0

Re: IPS issue

Sorry, but I don' understand those explanation.
Kudos0

Re: IPS issue

Not quite sure I understand your question. You will not see log entries in the Settings sections of your product. Only in the History.

Things happen. Export/Backup your Norton Password Manager data.
Kudos0

Re: IPS issue

If one computer uses different signatures I won't find anything in Intrusion and browser protection, right? If so, I'll check tomorrow what type of attack was used and was it from some different computers or from one...
Kudos0

Re: IPS issue

"Not quite sure I understand your question. You will not see log entries in the Settings sections of your product. Only in the History." - I mean that I can't find ip addresses in the list of blocked computers. What if want to unblock this computer? I couldn't do that because this list is empty, there is only some logs in Security Hostory...
Accepted Solution
Kudos1 Stats

Re: IPS issue

1) When an attack is detected, your Norton product automatically blocks the connection to ensure that your computer is safe.

2) If a computer uses a different attack signature than that used during the first attack, your Norton product activates Intrusion AutoBlock to block that computer.

Intrusion AutoBlock blocks all traffic between your computer and the attacking computer for a limited time.


Sounds like you're looking for Intrusion AutoBlock information when AutoBlock in not active. 
2) If a computer uses a different attack signature than that used during the first attack, your Norton product activates Intrusion AutoBlock to block that computer.


I've had lots of IPS Alerts.  Thankfully, AutoBlock was never activated.  
Malicious traffic probes for a hole.  Norton blocks.
If you're a target of repeat malicious traffic.  AutoBlock is activated.


Intrusion Prevention protects you from attacks when you are online. It scans network traffic for attack signatures, such as social threats and outbound attacks, that identify attempts to exploit vulnerabilities in your operating system or in a program that you use. To keep you secure, Intrusion Prevention discards packets from computers that try to send data with known attack signatures. It blocks connections to those computers.

 https://support.norton.com/sp/en/us/norton-security-with-backup/22.8.0.50/solutions/v15471442

Kudos1 Stats

Re: IPS issue

So Autoblock works only if attacking computer will try to hack me with different ways (and using different signatures)? If it happens only once I won't see attacking computer in the list of blocked right? I just thought that ALL attacks that I get should be in the list of Autoblock...

Kudos0

Re: IPS issue

So AutoBlock works only if attacking computer will try to hack me with different ways (and using different signatures)? If it happens only once I won't see attacking computer in the list of blocked right?

IPS Alert infers you were in the wrong place at the wrong time and came across malicious traffic.  Which is gonna' happen. 

Kudos0

Re: IPS issue

Thanks for detailed explanation bjm_! Norton is not so easy to understand as I thought :)
Kudos0

Re: IPS issue

Kudos for screenshots and best practice, IPS aware and familiar with Norton.
 

This thread is closed from further comment. Please visit the forum to start a new thread.