Basic category filters and overrides

When creating an application sensor, you can define the applications that you want to control. You can add applications and filters using categories, application overrides, and/or filter overrides with designated actions (monitor, allow, block, or quarantine).

Action	Description
Monitor	Passes the traffic and generates a log message.
Allow	Passes the traffic but does not generate a log message.
Block	Drops the detected traffic and generates a log message.
Quarantine	Blocks the traffic from an attacker IP address until the expiration time is reached and generates a log message.

For more information about application control logs, see Security Events log page.

To configure category filters in the GUI:

1. Go to Security Profiles > Application Control and click Create New, or edit an existing sensor.
2. Under Categories, click the icon next to the category name to set the action or view the application signatures.

   

3. If you select the Quarantine action, the Quarantine Duration pane will open. Enter the duration values and click OK.

   

4. Click OK.

To configure category filters in the CLI:

config application list
    edit <name>
        config entries
            edit <id>
                set category <id>
                set action {pass | block | reset}
                set quarantine {none | attacker}
                set quarantine-expiry <###d##h##m>
                set log {enable | disable}
            next
        end
    next
end

Configuring application and filter overrides

Multiple application signatures can be added for one sensor with a designated action. Filters can be added based on behavior, application category, popularity, protocol, risk, technology, or vendor subtypes.

To configure overrides in the GUI:

1. Go to Security Profiles > Application Control and click Create New, or edit an existing sensor.
2. In the Application and Filter Overrides table, click Create New.
3. Add an application:
   1. For Type, select Application.
   2. Select an Action from the dropdown.
   3. In the Search box, enter an application name and press Enter.
   4. In the search results, select desired the applications (you can select multiple applications) and click Add Selected.

      

   5. Click OK.
4. Add a filter:
   1. In the Application and Filter Overrides table, click Create New.
   2. For Type, select Filter.
   3. Select an Action from the dropdown.
   4. In the Filter field, click the + . The Select Entries pane opens, and you can search based on filter subtypes. This example has excessive bandwidth (under behavior) and game (under application category).

      

   5. Click OK.
5. Click OK.

To configure overrides in the CLI:

config application list
    edit <name>
        config entries
            edit <id>
                set protocols <integer>
                set risk <integer>
                set vendor <id>
                set technology <id>
                set behavior <id>
                set popularity <integer>
                set action {pass | block | reset}
                set log {enable | disable}
            next
        end
    next
end

protocols <integer>	Application protocol filter (0 - 47, or all).
risk <integer>	Risk or impact of allowing traffic from this application to occur (1 - 5; low (1), elevated (2), medium (3), high (4), and critical (5)).
vendor <id>	Application vendor filter (0 - 25, or all).
technology <id>	Application technology filter: all 0 (network-protocol) 1 (browser-based) 2 (client-server) 4 (peer-to-peer)
behavior <id>	Application behavior filter: all 2 (botnet) 3 (evasive) 5 (excessive bandwidth) 6 (tunneling) 9 (cloud)
popularity <integer>	Application popularity filter (1 - 5, from least to most popular).
action {pass | block | reset}	Pass/block traffic or reset the connection for traffic from this application (default = block).
log {enable | disable}	Enable/disable logging for this application list (default = enable).