HP ProCurve Threat Management Solution Implementation Guide 2009-05

3-39
HP ProCurve Network Immunity Manager with a Third-Party IDS/IPS
Step 2: Detect Threats
Figure 3-38. Adding a New Policy
d. Click OK. The new policy is displayed in the list of policies in the navigation bar.
4. Configure signature definitions.
a. If necessary, expand Signature Definitions in the navigation bar.
b. In the expanded list in the navigation bar, select the policy that you want to configure.
c. Configure actions.
You might want to define which actions are performed if an event occurs. When using
the sensor as an IPS, you may want to specify an action to prevent malicious traffic
from passing through the sensor. And for NIM to know that an event has occurred on
the sensor, you might also specify an action to trigger the IPS to send an SNMP trap
for that event.
i. In the navigation bar, select Active Signatures, as shown in Figure 3-39.
ii. In the right pane, select the specific signature or signatures for which you want
configure an action. (You can select several signatures, using Ctrl + click or Shift
+ click, and modify them all at once. Note, however, that while this might be more
efficient than changing signatures one by one, it might not be appropriate to give
all signatures the same set of actions.)
iii. Click Edit Actions on the toolbar.