How to submit Network Security Platform false positives and incorrect detections to Technical Support
Technical Articles ID:
KB55743
Last Modified: 3/26/2020
Environment
McAfee Network Security Manager (NSM) 9.x, 8.x
Summary
When you contact Technical Support directly or via the ServicePortal, you must provide the following information. This information enables Technical Support to accurately review incorrect identifications on the Network Security Platform:
- All version numbers for Sensor software, Manager software, and Signature Sets.
- Information about protocols in use on the network that are suspected of triggering the incorrect identification.
- Information about the applications suspected of generating the incorrect identifications. For example, version numbers and websites for more information.
- Evidence reports from the Manager. When possible, submit with full flow logging enabled for the specific alert.
- Enable full flow logging:
- NSM 8.1.x
- From the Manager Network Console, select Policy, Intrusion Prevention, IPS Policies.
- Click the Policies tab, open the Policy Editor, and click the appropriate policy.
NOTE: If the policy is a preinstalled or the default policy, clone it before changing it.
- Click View/Edit, and select Inbound or Outbound, depending on the direction of the suspected attacks you want checked.
- Select Attacks Selected. If the protocol is identified, select it from the list. Otherwise, click All Protocols.
- Click View/Edit, and select the attack that is suspected of being False/Positive.
- Click View/Edit, click the Logging tab, and click Enable Logging.
- Click the Log Entire Packet drop-down list. Select Single Flow in the Flow field, and then select Rest of Flow.
- Click OK, and then click Done.
- Click Commit Changes.
NOTE: If you cannot gather the information, use the following steps instead:
- Click Forensic Analysis (flows from/to source and flows from destination).
- Enter 30 (Packets) in the Capture n Packets drop-down list.
- Click OK, and then click Done.
- NSM 8.3.x, NSM 9.x
- Open the Manager console, click Policy, Intrusion Prevention, Policy Types, IPS Policies.
- Select the appropriate policy that is applied to the Sensor.
- Click Edit.
- Double-click the alert that requires full flow logging enabled.
- On the right side of the window, navigate to Settings, Sensor Actions, Capture Packets.
- Set Attack and Pre-Attack to Enabled.
- Set Post-Attack to Enabled.
- Set Flows to Capture to Attack Flow Only and Rest of Flow.
- Set Bytes to Capture to All Bytes in Each Packet.
- Click Update at the bottom right corner, then click Save.
You see a pop-up message with the updates displayed.
- Click Confirm.
- Deploy the changed policy to the Sensors:
- Click the Devices tab.
- Select the appropriate Device from the Device drop-down list.
- Click Deploy pending changes.
- Make sure that there is a check mark in the Configuration and signature set box.
- Click Deploy to push the update policy to the Sensor.
- Wait for the alert suspected to be a false positive to be triggered, then save the Evidence Report:
- NSM 8.1.x:
- Start Historical/Real-time Alert Manager and double-click the alert with the false positive.
- Click Save As Evidence Report.
- Click Save Packet Log.
- Select Show Entire Flow.
- Click Save. Name the file appropriately to save the Evidence Report. There are two files, PCAP and Report.csv in the Evidence Report.
NOTE: Ensure that you open the PCAP with Wireshark and verify that there are about 10 packets listed.
- Provide any additional information about why you suspect this alert is an incorrect identification, and any comments or thoughts about why the alert might have triggered.
- Perform a packet capture of the network traffic in question through a third-party application. Technical Support recommends Wireshark for this purpose.
IMPORTANT: Your submission requires a minimum of two Evidence Reports with packet logs attached. After you have submitted this information, Technical Support will work with the Network Security Platform Detection Team to confirm the incorrect identification and the best course of action to correct it.
- NSM 8.3.x and NSM 9.x:
- Click the Analysis tab then click the Attack log.
- Double-click the triggered attack suspected as a false positive. You see a window open on the right side.
- Click Export, select Alert details. You see the Export Alert Details window open.
- Click the Include Packet Capture box.
- In the Optional Comment field, add a comment why you suspect the alert is a false positive.
- Click Export and name the file. There are two files, PCAP and Report.csv in the Evidence Report.
NOTE: Open the PCAP with Wireshark and verify that there are about 10 packets listed.
- Provide any additional information about why you suspect the alert is an incorrect identification and any comments or thoughts about why the alert might have triggered.
- Perform a packet capture of the network traffic in question through a third-party application. Technical Support recommends Wireshark for this purpose.
IMPORTANT: Your submission requires a minimum of two Evidence Reports with packet logs attached. Technical Support works with the Network Security Platform Detection Team to confirm the incorrect identification and the best course of action to correct it.
Previous Document ID
KB39353
|
