HP ProCurve Threat Management Solution Implementation Guide 2009-05

3-41
HP ProCurve Network Immunity Manager with a Third-Party IDS/IPS
Step 2: Detect Threats
v. Click OK. The new actions are added to the Actions column for the signature.
Figure 3-40. Signature Window Showing New Actions
vi. Make sure the Enabled checkbox is selected. If it is not, select it.
By default, when the sensor takes an action it maintains that action until you
reverse it manually. For instance, if it responds to an event by denying the
attacker’s traffic, it will continue to deny that attacker’s traffic until you tell it
otherwise.
5. To decrease manual intervention, set a timeout for the action, after which it will revert to
its default state. (This step is optional.)
i. Select the signature for which you want to set a timeout.
ii. Click Edit on the toolbar. The Edit Signature window is displayed.
iii. Scroll down to the Event Counter section and find the Specify Alert Interval entry. In
the Value column, click the value (which is set to No by default) and select Yes in
the drop-down list that is displayed.