Signature Set Updates Failure To keep your systems protected from the latest threats, NIS must have connectivity to the appropriate update source ( or ) and updated with latest signature sets. NIS will trigger an alert on any failure to update the latest signature set and display a warning on the Forefront TMG management console Alerts tab. When the signatures are up to date, the Update Center appears as follows:: Figure 36: Forefront TMG Update Center NIS will alert if it hasn’t received updates for more than certain number of days. This number is configurable through the NIS Tasks. Select Configure Properties and then select the Definition Updates tab. This threshold is 45 days by default: Figure 37: Threshold for triggering a “NIS signatures out of date” alert The following table lists the possible NIS alerts for signature set updates along with the corresponding troubleshooting steps. The alerts are listed in the Forefront TMG management console Alerts tab. Select the Monitoring node in the left pane to see that tab. Table 3: Troubleshooting signature updates Name Severity Description Troubleshooting #1 Update Failed Error An error occurred during an attempt to check for, download, or install definition updates on the server <server-name> Check Forefront TMG connectivity to Microsoft Update Verify WinHTTP proxy settings Use the error code for further investigation #2 NIS Signature Set Loading Failed Error NIS failed to load the signature set file on the server because the current signature set file is missing or is corrupted. Take the following steps: Select the Update Center node in the left pane Select the NIS entry in the Definition Updates pane Select Override Current Definitions #3 NIS Selected Signature Set Loading Failure Error The server is configured to use the selected signature set <name> instead of the latest signature set retrieved by Forefront TMG but NIS will use the latest To stop using the selected signature and start using the latest released signature, follow these steps: Select the Intrusion Prevention System node in the left pane
signature set because the selected signature set could not be loaded on the specified server. Select Configure Properties from the NIS Tasks menu. Select the Definition Updates tab Click Version Control… Uncheck Select the NIS signature set you want to activate option #4 Update Center - Updates Not Installed Warning One or more protection mechanisms did not install updates during the last <number of days> days. Protection mechanisms that did not install updates: Network Inspection System. When a protection mechanism is configured to for updates and not to install them automatically, available updates must be installed manually from the Update Center node. To enable automatic updates: Select the Intrusion Prevention System node in the left pane Select Configure Properties from the NIS Tasks menu. Select the Definition Updates tab Set Automatic definition update action to check for and install definitions (recommended) Set Response policy for new signatures to Microsoft default policy (recommended) To manually install update, Select the Update Center node in the left pane Select the NIS entry in the Definition Updates pane Select for and Install New Definitions option from its right-click menu #5 Update Center Required Service Not Started The Update Center cannot obtain updates on the server because the Forefront TMG Job Scheduler service is not started. Select the Monitoring node in the left pane Select the Services pane Right click Microsoft Forefront TMG Job Scheduler Select Start (see screen shot below) The following events NIS updates are informational and are not indicative of any failure:
Table 4: Non-failure signature events Name Severity Description Action #1 NIS succeeded to load the signature set Info NIS succeeded to load the signature set No action needed #2 Definition Updates Installed Info One or more new definition updates for the Network inspection System were installed successfully on the server <server-name>. The new definitions are effective for new connections only. No action needed #3 Definition Updates Available Warning New definition updates for the Network inspection System on the server <server-name> are available, but they were not installed because Forefront TMG is configured to check for updates and not to install them automatically. The following updates are available for installation: <NIS, AM …> You should turn on automatic updates: Select the Intrusion Prevention System node in the left pane Select Configure Properties from the NIS menu. Select the Definition Updates tab Set Automatic definition update action to check for and install definitions (recommended) Set Response policy for new signatures to Microsoft default policy (recommended) Potentially Incorrect Detections In rare cases, NIS may incorrectly detect legitimate traffic as a potential threat and block it if configured to do so. The NIS team uses telemetry to constantly enhance the quality of protocol decoders. In particular, the MMPC uses telemetry to maintain high-quality signatures in order to minimize the impact of incorrect detections and quickly respond to such events. If an incorrect detection is found, the updates follow a roll-forward model. A revised signature is then created, tested, and published to supersede the previous one. This way, customers benefit from the protection against the other emerging threats that are addressed by the newer signature set. For information about the MMPC response please see the section.
if the user-defined "Custom HTTP" protocol is configured to use that filter, will it be possible to select the HTTP protocol from the list of protocols. Figure 42: Selecting the application filter Detection Related NIS Alerts Here is the list of NIS alerts for detection issues. alerts are informational and do not necessarily indicate any problem. 5: NIS detection alerts Name Severity Description Action #1 NIS blocked traffic Info The Network Inspection System blocked traffic because it matched the vulnerability signature <Signature Name>. See the log for more details. Additional information about the signature can be found at <URL>. The currently installed Network Inspection System set version is <version>. If there is reason to believe that the session block is inaccurate, consider setting the signature to Detect Only and report the issue to Forefront TMG Customer Service. See the section for more details. #2 NIS detected traffic Info The Network Inspection System detected traffic that matches the vulnerability signature <signature name>. The traffic was not blocked because the signature is configured for detection only mode. See the log for more details. Additional information the signature can be found at <URL>. The currently installed Network Inspection System set version is <version>. You should use the default response policy: Select the Intrusion Prevention System node in the left pane Select Configure Properties from the NIS menu. Select the Definition Updates tab Set Response policy for new signatures to Microsoft default policy (recommended) For a specific signature that is configured to use non-default response: Select the Intrusion Prevention System node in the left pane