if the user-defined "Custom HTTP" protocol is configured to use that filter, will it be possible to select the HTTP protocol from the list of protocols. Figure 42: Selecting the application filter Detection Related NIS Alerts Here is the list of NIS alerts for detection issues. alerts are informational and do not necessarily indicate any problem. 5: NIS detection alerts Name Severity Description Action #1 NIS blocked Info The Network If there is reason to believe that traffic Inspection System the session block is inaccurate, blocked traffic because consider setting the signature to it matched the Detect Only and report the issue vulnerability signature to Forefront TMG Customer <Signature Name>. See Service. See the section for more the log for more details. details. Additional information about the signature can be found at <URL>. The currently installed Network Inspection System set version is <version>. #2 NIS detected Info The Network You should use the default traffic Inspection System response policy: detected traffic that Select the Intrusion matches the Prevention System node vulnerability signature in the left pane <signature name>. The Select Configure traffic was not blocked Properties from the NIS because the signature menu. is configured for Select the Definition detection only mode. tab Updates See the log for more Set Response policy for details. Additional new signatures to information the Microsoft default policy signature can be found (recommended) at <URL>. The For a specific signature that is currently installed configured to use non-default Network Inspection response: System set version is Select the Intrusion <version>. Prevention System node in the left pane
if the user-defined "Custom HTTP" protocol is configured to use that filter, will it be possible to select the HTTP protocol from the list of protocols. Figure 42: Selecting the application filter Detection Related NIS Alerts Here is the list of NIS alerts for detection issues. alerts are informational and do not necessarily indicate any problem. 5: NIS detection alerts Name Severity Description Action #1 NIS blocked traffic Info The Network Inspection System blocked traffic because it matched the vulnerability signature <Signature Name>. See the log for more details. Additional information about the signature can be found at <URL>. The currently installed Network Inspection System set version is <version>. If there is reason to believe that the session block is inaccurate, consider setting the signature to Detect Only and report the issue to Forefront TMG Customer Service. See the section for more details. #2 NIS detected traffic Info The Network Inspection System detected traffic that matches the vulnerability signature <signature name>. The traffic was not blocked because the signature is configured for detection only mode. See the log for more details. Additional information the signature can be found at <URL>. The currently installed Network Inspection System set version is <version>. You should use the default response policy: Select the Intrusion Prevention System node in the left pane Select Configure Properties from the NIS menu. Select the Definition Updates tab Set Response policy for new signatures to Microsoft default policy (recommended) For a specific signature that is configured to use non-default response: Select the Intrusion Prevention System node in the left pane
NIS%20in%20TMG%20Whitepaper.docx