Forum Discussion
omar_padilla
Altocumulus
Altocumulushelp -best option about parameter learning!!
hello I have a question regarding the learning of the parameters, which would be the best method to use in an implementation never, always, selective, I think that by discarding never is not the best...
Yoann_Le_Corvi1
Cumulonimbus
CumulonimbusHi
The short answer is (unfortunately) : it depends ! :)
It depends how strict you want to be on the policy, and how much time you have available for the job.
Always : once policy is stabilized, wildcard is removed any parameter not in the list will be blocked.
Selective : wilcard remains, paramters are allowed, but if you have to relax a setting (e.g. disable an attack signature) this will be applied only to the relevant parameter and not to all of them
Never : wildcard remain, and if you relax a setting (e.g. disable an attack signature) this will be applied to the wildcard, i.e. all parameters.
So no real "rule" unfortunately.
Hope this helps in the reflexion ?
Yoann
