Configure Intrusion Prevention

Configure the Intrusion Prevention module (IDS/IPS) to define its behavior for a policy.

When designing the modules behavior and implementing it using the API, use the same background information and guidance that is provided in the Deep Security Help Center.

Policy objects contain two objects that you use to configure the Intrusion Prevention module:

  • IntrusionPreventionPolicyExtension: Controls the module state (prevent, detect, or off), identifies the applied Intrusion Prevention rules, and identifies application types that are assigned to the module.
  • PolicySettings: Policy settings include many Intrusion Prevention-related settings that control the runtime behavior of the module, such as the application of recommendation scans, network engine settings, and the use of NSX security tags.

After you create these objects and add them to a Policy object, you use the PoliciesApi class to modify an existing policy based on the Policy object.

The following JSON represents the data structure of an IntrusionPreventionPolicyExtension object:

{
    "state": "prevent",
    "moduleStatus": {...},
    "ruleIDs": [...],
    "applicationTypeIDs": [...]
}

The moduleStatus property is read-only. It provides the runtime status of the Intrusion Prevention module. (See Report on Computer Status.)

General steps

Use the following steps to configure the Intrusion Prevention module:

  1. Create an IntrusionPreventionPolicyExtension object and configure the properties (Python, JavaScript, Java).
  2. Create a PolicySettings object to configure runtime settings of the module (Python, JavaScript, Java).
  3. Create a Policy object and add the IntrusionPreventionPolicyExtension and PolicySettings objects.
  4. Use a PoliciesApi object to add or update the policy on Deep Security Manager (Python, JavaScript, Java).
Tip:

If you only need to set a single Intrusion Prevention-related policy setting, see Configure a single policy or default policy setting.

For a complete example that creates a PolicySettings object and sets the module state, assigns rules, and sets the value of the intrusionPreventionSettingAutoApplyRecommendationsEnables property to cause intrusion prevention to automatically apply rules found via recommendation scans, see: Python, JavaScript, Java.

Also see the Modify a Policy operation in the API Reference.

If you only need to add, remove, or list Intrusion Prevention rules for a policy, use the PolicyIntrusionPreventionRuleAssignmentsApi class. The previous example uses the IntrusionPreventionPolicyExtension, Policy, and PoliciesApi classes to add Intrusion Prevention rules, but this can also be done using only the PolicyIntrusionPreventionRuleAssignmentsApi class. For more information, see Policy Intrusion Prevention Rule Assignments and Recommendations in the API Reference.

For information about authenticating API calls, see Authenticate with Deep Security Manager.

Create an Intrusion Prevention rule

Generally, to create a rule for the Intrusion Prevention module you perform the following steps:

  1. Create an IntrusionPreventionRule object.
  2. Set the rule properties. The properties are described in the Deep Security Help Center.
  3. Use an IntrusionPreventionRulesApi object to add the rule to Deep Security Manager.
Tip:

Although Log Inspection rules have different properties than Intrusion Prevention rules, the way you create the rules are similar. You might find the Create a basic Log Inspection rule example helpful.

Note:

Configuration options of Intrusion Prevention rules are not accessible using the API. To change these options, in the Deep Security Manager console open the rule properties and click the Configuration tab.