Threat Prevention Scheduled Updates - Custom Threat Prevention

Introduction to Scheduled Updates

Check Point wants the customer to be protected. When a protection update is available, Check Point wants the configuration to be automatically enforced on the gateway. You can configure automatic gateway updates for Anti-VirusClosed Check Point Software Blade on a Security Gateway that uses real-time virus signatures and anomaly-based protections from ThreatCloud to detect and block malware at the Security Gateway before users are affected. Acronym: AV., Anti-BotClosed Check Point Software Blade on a Security Gateway that blocks botnet behavior and communication to Command and Control (C&C) centers. Acronyms: AB, ABOT., Threat EmulationClosed Check Point Software Blade on a Security Gateway that monitors the behavior of files in a sandbox to determine whether or not they are malicious. Acronym: TE. and IPSClosed Check Point Software Blade on a Security Gateway that inspects and analyzes packets and data for numerous types of risks (Intrusion Prevention System)..

For Anti-Virus, Anti-BotClosed Malicious software that neutralizes Anti-Virus defenses, connects to a Command and Control center for instructions from cyber criminals, and carries out the instructions. and Threat Emulation, the gateways download the updates directly from the Check Point cloud.

For IPS, prior to R80.20, the updates were downloaded to the Security Management ServerClosed Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server., and only after you installed policy, the gateways could enforce the updates. Starting from R80.20, the gateways can directly download the updates. For R80.20 gateways and higher with no internet connectivity, you must still install policy to enforce the updates.

When you configure automatic IPS updates on the gateway, the action for the newly downloaded protections is by default according to the profile settings.

IPS, Anti-Virus and Anti-Bot updates are performed every two hours by default. Threat Emulation engine updates are performed daily at 05:00 by default, and Threat Emulation image updates are performed daily at 04:00 by default.

You can see the list of Anti-Bot and Anti-Virus protections in Custom Policy Tools > Protections, and the list of IPS protections in Custom Policy Tools > IPS Protections. The update date appears next to each protection.

Configuring Threat Prevention Scheduled Updates

In SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on., go to Security Policies > Threat Prevention > Custom Policy > Custom Policy Tools

Step

Instructions

1

Go to Updates.

2

Go to the section about the required Software BladeClosed Specific security solution (module): (1) On a Security Gateway, each Software Blade inspects specific characteristics of the traffic (2) On a Management Server, each Software Blade enables different management capabilities., click Schedule Update.

The Scheduled Updates window opens.

3

Make sure Enable <blade> scheduled updates is selected.

4

  • On successful IPS update on the Security Management Server, install policy on the Security Gateway - automatically installs the policy on the devices you select after the IPS update is completed. Click Configure to select these devices.
    Note - In pre-R80gateways, IPS was part of the Access Control policy. Therefore, when you select this option, a message shows which indicates that for pre-R80 gateways, the Access Control policy is installed and for R80 and above gateways, the Threat Prevention policy is installed.

  • Perform retries on the Security Management Server when the update fails - lets you configure the number of tries the scheduled update makes if it does not complete successfully the first time.

5

Click Configure.

6

  • Update every: set the update frequency by hours

    OR -

  • Update at: set the update frequency by days:

    • Daily - Every day

    • Days in week - Select days of the week

    • Days in month - Select dates of the month

7

Click OK.

8

Click Close.

9

Install the Threat Prevention policy.

Checking Update Status

In Custom Policy Tools > Update, a message shows which indicates the number of gateways which are up-to-date.

Step

Instructions

1

In the Gateways & Servers view, select a gateway.

2

Right-click the gateway, and select the Monitor button.

The Device & License Information window opens.

3

The Device Status page shows the gateway status.

Turning Off IPS Automatic Updates on a Gateway

You can turn off automatic IPS updates on a specific gateway.

Step

Instructions

1

In SmartConsole, to the Gateways & Servers view, and double-click a gateway.

The gateway properties window opens.

2

In the navigation tree, go to IPS.

3

In IPS Update Policy, select Use IPS management updates.

4

Click OK.

5

Install the Threat Prevention Policy.

IPS Updates Use Cases

These scenarios explain how an upgrade of the Security Gateways or the Security Management ServerClosed Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. or both, affects the Scheduled Updates configuration.

Upgrading the Security Management Server to R80.20, and not upgrading the gateways to R80.20

If you do not upgrade the Security Gateways, then after the upgrade, the Security Gateways are still not able to receive the updates independently, only through the Security Management Server. In this case, the configuration stays the same compared to before the upgrade: Scheduled Updates will be enabled or disabled on the Security Management Server, depending on the configuration before the upgrade.

Upgrading the Security Gateways to R80.20 (with or without Security Management Server upgrade)

  • If, before the upgrade, Scheduled Updates were configured on the Security Management Server with automatic policy installation, then after the upgrade, automatic IPS updates are still enabled on the Security Management Server, and are also applied to the upgraded gateways.

  • If Scheduled Updates were disabled on the Security Management Server before the upgrade, then they remain disabled after the upgrade, both on the Security Management Server and the gateways.

  • If, before the upgrade, Scheduled Updates were configured on the Security Management Server without automatic policy installation - then during the first policy installation after upgrade, a message shows which indicates that Security Gateways R80.20 and higher automatically update the IPS Protections. For Security Gateways R80.10 and lower, you must install policy to apply the updates.