Customers may observe unexpected behavior in their monitoring systems after applying Intrusion Detection and Prevention (IDP) on security policies. Specifically:

• Medium category attack signatures are being dropped
• Critical category attack signatures are being allowed

This behavior may appear inconsistent with expectations, as higher-severity threats are typically assumed to be blocked by default.

IDP actions are not applied solely based on severity level (Critical, Medium, Low).

Instead, the enforcement behavior depends on the recommended action defined for each individual attack signature by Juniper Threat Labs.

Each IDP signature has a predefined recommended action such as:

• Allow
• Drop
• Close
• Reset
• Log only

As a result:

• Some medium-severity signatures may have a recommended action of Drop
• Some critical-severity signatures may have a recommended action of Allow or Log

This is expected behavior when IDP is configured to follow recommended actions.

To verify or understand why a specific signature is being allowed or dropped:

1. Identify the signature ID or name shown in logs or monitoring output.
2. Check the recommended action for that signature in the Juniper IPS signature database.

The recommended action determines how the traffic is handled when IDP is applied using default or recommended settings.

You can verify the recommended action for each individual IDP signature at the following page:

https://www.juniper.net/us/en/threatlabs/ips-signatures.html

NOTE:

If stricter enforcement is required, customers can:

• Customize IDP policies
• Override recommended actions for specific severity levels or signatures

Changes should be carefully evaluated to avoid false positives and unintended traffic drops.