Issue
- You experience a higher number of false positive detections "TCP port scanning attack" from IDS modules in ESET Server Security for Windows Server and ESET Security for Microsoft SharePoint
Solution
To mitigate these detections in internal network we recommend to create IDS exceptions.
To create a new IDS exception:
Open the ESET Server Security Advanced setup available by right-clicking the system tray (Windows notification area) icon
. Select Network acess protection from the main menu, then expand Network attack protection section, click Edit next to IDS rules.
Figure 1-1 In the IDS rules window, click Add.
Figure 1-2 Add IDS rule window will open. From the Detection drop-down menu select TCP port scanning attack. From the Direction drop-down menu select Both.
Specify a list of IP addresses (IPv4 or IPv6) or subnets. For multiple entries use comma as a delimiter.
Configure Action for IDS exception by selecting No. Do this for each Action type (Block, Notify, Log).
Figure 1-3
