You can enable intrusion detection by setting the Mode to Detection under Security & SD-WAN > Configure > Threat protection > Intrusion detection and prevention. When enabling intrusion detection, there are three distinct detection rulesets to choose from using the Ruleset selector: Connectivity: Contains rules from the current year and the previous two years for vulnerabilities with a CVSS score of 10. Balanced: Contains rules that are from the current year and the previous two years, are for vulnerabilities with a CVSS score of 9 or greater, and are in one of the following categories: Malware-CNC: Rules for known malicious command and control activity for identified botnet traffic. This includes call home, downloading of dropped files, and exfiltration of data. Blacklist: Rules for URIs, user agents, DNS hostnames, and IP addresses that have been determined to be indicators of malicious activity. SQL Injection: Rules that are designed to detect SQL Injection attempts. Exploit-kit: Rules that are designed to detect exploit kit activity. Security: Contains rules that are from the current year and the previous three years, are for vulnerabilities with a CVSS score of 8 or greater, and are in one of the following categories: Malware-CNC: Rules for known malicious command and control activity for identified botnet traffic. This includes call home, downloading of dropped files, and exfiltration of data. Blacklist: Rules for URIs, user agents, DNS hostnames, and IP addresses that have been determined to be indicators of malicious activity. SQL Injection: Rules that are designed to detect SQL Injection attempts. Exploit-kit: Rules that are designed to detect exploit kit activity. App-detect: Rules that look for and control the traffic of certain applications that generate network activity. The Balanced ruleset will be selected by default. You are able to see more in Configuring_Intrusion_Detection_and_Prevention.
... View more