Advanced Threat Prevention Engine Settings

In the Threat Prevention > Threat Prevention Engine Settings page you can configure advanced configuration settings for the IPS, Anti-VirusClosed Software Blade on a Spark Firewall that uses real-time virus signatures and anomaly-based protections from ThreatCloud to detect and block malware at the [Spark Firewall before users are affected. Acronym: AV., Anti-BotClosed Software Blade on a Spark Firewall that blocks botnet behavior and communication to Command and Control (C&C) centers. Acronyms: AB, ABOT. & DNS Security, Threat EmulationClosed Software Blade on a Spark Firewall that monitors the behavior of files in a sandbox to determine whether or not they are malicious. Acronym: TE., and Zero Phishing engines.

Note - Many of the configurations below are advanced and should only be used by experienced administrators.

IPS

Configure the settings for newly downloaded protections:

  • Active

  • Detect

  • Inactive

To configure the IPS engine to bypass mode when the appliance is under heavy load:

  1. Select the Bypass under load checkbox to activate the feature.

  2. Click Configure to select the thresholds upon which IPS engine toggles between bypass and inspection modes. Follow the instructions in the window that opens and click Apply.

    Configure maximum ("high") and minimum ("low") thresholds for CPU Usage and Memory Usage. Bypass. This way when under load, the IPS engine does not toggle between modes too frequently.

    • Start the Threat Prevention bypass (IPS inspection is disabled) when the CPU utilization or Memory utilization increase above the configured maximum ("high") threshold.

      During this bypass, the specified Threat Prevention features allow traffic without inspection.

      This makes sure the Security GatewayClosed A dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. has enough CPU and Memory resources to inspect the traffic and maintain connectivity to the Security Gateway.

    • Stop the Threat Prevention bypass (IPS inspection is re-enabled) when the CPU utilization or Memory utilization decreases below the configured minimum ("low") threshold.

      The specified Threat Prevention features start to inspect the traffic again.

      Note - The default durations for starting or stopping the bypass is the same for all features.

  3. In Bypass under load tracking, to configure tracking options for this feature, select what type of log to issue.

To enable Detect-only mode:

Select the checkbox.

To import IPS protections:

Click the link.

Anti-Virus

Anti-Virus scans incoming files for viruses.

The mail settings include:

  • SMTP - Simple Mail Transfer Protocol is a communication protocol for electronic mail transmission.

  • POP3 - Uses the POP3 protocol to send and receive emails with TLS encryption.

  • IMAP - Internet standard protocol used by email clients to retrieve email messages from a mail server over a TCP/IP connection. It allows you to access your email from any device.

To enable POP3S or IMAP scans, you must enable SSL traffic inspection:

  1. On the Threat Prevention > Engine Settings page, under Anti-Virus Scanned protocols, select the Mail (SMTP, POP3 and IMAP) checkbox.

  2. On the Access Policy > SSL Inspection Policy page, select the checkbox to enable SSL traffic inspection.

  3. Under Protocols to inspect, select POP3S or IMAP.

  4. Click Apply

To configure the Anti-Virus settings:

  1. Select one of the protected scope options:

    • Scan incoming files from - Select one of these interfaces from which to scan incoming files:

      • External and DMZ - Files that originate from external and the DMZ interfaces are inspected.

        Note - DMZ is not supported in 1530 / 1550 appliances.

      • External - Files that originate from external interfaces are inspected.

      • All - Files transferred between all interfaces are inspected.

    • Scan both incoming and outgoing files - Files that originate from outside the organization and from within the organization to the Internet are inspected.

  2. Select the protocols to scan for the selected scope:

    • HTTP (on any port)

    • Mail (SMTP, POP3 and IMAP

    • FTP - Disabled by default.

      To activate FTP:

      1. In the WebUI go to Home > Security Dashboard and turn on the Anti-Virus Software Blade.

      2. Connect to the command line and run this command:

        set threat-prevention anti-virus policy protocol-ftp true

      3. Install Policy.

    You must activate the SSL traffic inspection to scan HTTP and IMAP encrypted traffic. To activate, click the link or go to Access Policy > SSL Inspection Policy.

  3. Select one of the file type policy options:

    • Process file types known to contain malware

    • Process all file types

    • Process specific file type families - Click Configure for a list of file types and set prescribed actions to take place when these files pass through the Anti-Virus engine. To edit an action for a specified file type, right-click the row and click Edit.

      The available actions are:

      • Scan - The Anti-Virus engine scans files of this type.

      • Block - The Anti-Virus engine does not allow files of this type to pass through it.

      • Pass - The Anti-Virus engine does not inspect files of this type and lets them pass through.

        You cannot delete system defined file types. System defined file types are recognized by built-in signatures that cannot be edited. Manually defined file types are recognized by their extension and are supported through the web and mail protocols.

  4. You can set policy overrides to override the general policy setting defined on the Threat Prevention Blade Control page. For each of the below protection type options, you can set the applicable override action: AskClosed UserCheck rule action that blocks traffic and files and shows a UserCheck message. The user can agree to allow the activity., PreventClosed UserCheck rule action that blocks traffic and files and can show a UserCheck message., DetectClosed UserCheck rule action that allows traffic and files to enter the internal network and logs them., Inactive, or According to policy (no override). See the Threat Prevention > Threat Prevention Blade Control page for a description of the action types.

    • URLs with malware - Protections related to URLs that are used for malware distribution and malware infection servers.

    • Viruses - Real-time protection from the latest malware and viruses by examining each file against the Check Point ThreatCloud database.

To enable Detect-only mode:

Select the checkbox.

Anti-Bot & DNS Security

You can set policy overrides to override the general policy settings defined on the Threat Prevention Blade Control page. For each of the protection type options, you can set the applicable override action: Ask, Prevent, Detect, Inactive, or According to policy (no override). See the Threat Prevention > Threat Prevention Blade Control page for a description of the action types.

  • Malicious activity - Protections related to unique communication patterns of botnet and malware specified families.

  • Reputation domains - Protections related to Command & Control (C2) servers. Each host is checked against the Check Point ThreatCloud reputation database.

  • Reputation IPs - Protections related to Command & Control (C2) servers. Each IP is checked against the Check Point ThreatCloud reputation database.

  • Reputation URLs - Protections related to Command & Control (C2) servers. Each URL is checked against the Check Point ThreatCloud reputation database.

  • Unusual activity - Protections related to the behavior patterns common to botnet and malware activity.

To enable Detect-only mode:

Select the checkbox.

DNS Advanced Settings

DNS Security protections are part of the Anti-Bot Software Blade. They include:

  • Domain generation algorithm is when malware automatically creates hundreds or thousands of domain names to enable infected devices to find a newly registered command-and-control (C2) server without a single, easily blocked domain.

  • The DNS tunneling protection protects against threats that manipulate the DNS protocol to route DNS requests to an attacker-controlled server.

  • The NXNS attack detection detects attacks that exploit vulnerabilities in the recursive DNS resolver to launch amplified denial-of-service (DDoS) attacks.

  • The DNS Over HTTPS Protocol encrypts and authenticates communications between DNS clients and servers using the HTTPS protocol. DNS queries are encoded in the same format as web requests and subject to the same encryption and authentication as web traffic. This makes it more difficult to intercept or tamper with DNS queries.

To enable DNS protections:

  1. Select the checkbox next to the protection name.

  2. Click Save.

Threat Emulation

To configure the Threat Emulation settings:

  1. Select one of the protected scope options:

    • Scan Incoming files from - Select one of these interfaces from which to scan incoming files:

      • External and DMZ - Files that originate from external and the DMZ interfaces are inspected.

        Note - DMZ is not supported in 1530 / 1550 appliances.

      • External - Files that originate from external interfaces are inspected.

      • All - Files transferred between all interfaces are inspected.

        Note - LAN to LAN scanning is not supported.

    • Scan both incoming and outgoing files - Files that originate from outside the organization and from within the organization to the Internet are inspected.

  2. Select the protocols to scan for the selected scope:

    • HTTP (on any port)

    • Mail (SMTP, POP3 and IMAP.

      You must activate the SSL traffic inspection to scan HTTP and IMAP encrypted traffic. To activate, click the link or go to Access Policy > SSL Inspection Policy.

  3. For file type policy:

    Process specific file type families - Click Configure for a list of file types and set prescribed actions to take place when these files pass through the Threat Emulation engine.

    To edit an action for a specified file type, right-click the row and click Edit. You can also click the file type so it is selected and then Click Edit.

    The available actions are:

    • Inspect - The Threat Emulation engine inspects files of this type.

    • Bypass - The Threat Emulation engine does not inspect files of this type and lets them pass through.

      You cannot delete system defined file types. System defined file types are recognized by built-in signatures that cannot be edited.

  4. Select the HTTP connection emulation handling mode:

    • Background - Connections are allowed until emulation is complete.

    • Hold - Connections are blocked until emulation is complete.

In Threat Emulation, each file is run in the Check Point Public ThreatCloud to see if the file is malicious. The verdict is returned to the gateway.

You can change the emulator location to a local private SandBlast appliance in the Advanced Settings page.

You must first enable the Threat Emulation blade and then configure it for remote emulation.

To enable the Remote Private Cloud Threat Emulation emulator:

  1. Go to Device > Advanced Settings.

  2. Search for Threat Prevention Threat Emulation policy - Emulation location.

  3. Select Emulation is done on remote (private) SandBlast.

  4. Add or update the emulator IP address.

  5. Click Apply

To disable the Remote Private Cloud Threat Emulation emulator:

  1. Go to Device > Advanced Settings.

  2. Search for Threat Prevention Threat Emulation policy - Emulation location.

  3. Select Emulation is done on Public ThreatCloud.

  4. Click Apply

To configure multiple remote emulators, you must use CLI commands.

For more information on Threat Emulation, see the Threat Emulation video on the Small Business Security video channel.

To enable Detect-only mode:

Select the checkbox.

Zero Phishing

You can use Zero Phishing in one of these ways:

  • Phishing Prevention - Detects static forms in the HTML. Based on URL reputation, ThreatCloud blocks access if it determines this is a phishing site. This is the default option.

  • In-Browser Phishing Prevention - Select the checkbox for this option. Uses JavaScript injections that run in the user's web browser. When the web page loads or you click in a login field, the JavaScript code checks the site's URL and its data. Based on the ThreatCloud classification and the policy configuration, the site is blocked if found to be malicious.

    Note:

    • Zero Phishing In-Browser protection does not work when Phishing Prevention is enabled.

    • QUIC inspection is disabled when Zero Phishing is enabled in Strict mode.

Select the checkbox for Detect-only mode. In this mode, phishing sites are detected but the sites are not blocked.

User Messages

You can customize user messages for Anti-Virus, Anti-Bot & Advanced DNS, and Zero Phishing. When traffic is matched for a protection type, the user's internet browser shows the user message in a new window.

To customize the message:

  1. Click Customize user message...

  2. Select one of the tabs and configure the fields:

    Tab

    Notification

    Ask

    Shows a message to users and asks them if they want to continue to access a site or server, or download a file that was classified as malicious. You can:

    • Edit the Ask subject and Ask body fields to your specifications and include Optional keywords... in the message.

    • Edit the Ignore text field and select if a user must enter a reason for this action.

    • Set the Fallback action: Block or Accept

    • Set the Frequency for the message to appear: Once a day, Once a week, Once a month)

    Block

    Shows a message to users and blocks the site. You can:

    • Edit the Block subject and Block body fields to your specifications and include Optional keywords...

    • Select to redirect the user to a custom URL in case of a block action.

    Customize

    (Optional) upload your company log instead of using the default Check Point logo.
  3. Click Save.