Table 4: Non-failure signature events Name Severity Description Action NIS succeeded Info NIS succeeded to load No action needed #1 to load the the signature set signature set #2 Definition Info One or more new No action needed Updates definition updates for Installed the Network inspection System were installed successfully on the server <server-name>. The new definitions are effective for new connections only. #3 Definition Warning New definition You should turn on automatic Updates updates for the updates: Available Network inspection Select the Intrusion System on the server Prevention System <server-name> are node in the left pane available, but they Select Configure were not installed Properties from the because Forefront NIS menu. TMG is configured to Select the Definition check for updates and Updates tab not to install them Set Automatic automatically. The definition update following updates are action to check for available for and install installation: <NIS, AM definitions …> (recommended) Set Response policy for new signatures to Microsoft default policy (recommended) Potentially Incorrect Detections In rare cases, NIS may incorrectly detect legitimate traffic as a potential threat and block it if configured to do so. The NIS team uses telemetry to constantly enhance the quality of protocol decoders. In particular, the MMPC uses telemetry to maintain high-quality signatures in order to minimize the impact of incorrect detections and quickly respond to such events. If an incorrect detection is found, the updates follow a roll-forward model. A revised signature is then created, tested, and published to supersede the previous one. This way, customers benefit from the protection against the other emerging threats that are addressed by the newer signature set. For information about the MMPC response please see the section.
Table 4: Non-failure signature events Name Severity Description Action #1 NIS succeeded to load the signature set Info NIS succeeded to load the signature set No action needed #2 Definition Updates Installed Info One or more new definition updates for the Network inspection System were installed successfully on the server <server-name>. The new definitions are effective for new connections only. No action needed #3 Definition Updates Available Warning New definition updates for the Network inspection System on the server <server-name> are available, but they were not installed because Forefront TMG is configured to check for updates and not to install them automatically. The following updates are available for installation: <NIS, AM …> You should turn on automatic updates: Select the Intrusion Prevention System node in the left pane Select Configure Properties from the NIS menu. Select the Definition Updates tab Set Automatic definition update action to check for and install definitions (recommended) Set Response policy for new signatures to Microsoft default policy (recommended) Potentially Incorrect Detections In rare cases, NIS may incorrectly detect legitimate traffic as a potential threat and block it if configured to do so. The NIS team uses telemetry to constantly enhance the quality of protocol decoders. In particular, the MMPC uses telemetry to maintain high-quality signatures in order to minimize the impact of incorrect detections and quickly respond to such events. If an incorrect detection is found, the updates follow a roll-forward model. A revised signature is then created, tested, and published to supersede the previous one. This way, customers benefit from the protection against the other emerging threats that are addressed by the newer signature set. For information about the MMPC response please see the section.
NIS%20in%20TMG%20Whitepaper.docx