Configuring Infinity Threat Prevention

To configure Infinity Threat Prevention in your environment, follow these steps:

Note - - MTA ( Mail Transfer Agent) is not supported with Infinity Threat Prevention. Gateways configured as MTAs can be managed by the traditional Threat Prevention policy.

Exceptions

Global exceptions are available for use by gateways configured as Infinity Threat Prevention or by gateways configured with the traditional Threat Prevention policy. Global exceptions that existed prior to the migration to Infinity Threat Prevention are enforced in Infinity Threat Prevention without any action needed.

To add global exceptions to the Infinity Threat Prevention policy:

  1. Go to the Security Policies view > Threat Prevention > Exceptions > Global Exceptions.

  2. Add the applicable exceptions.

  3. In the Install On column, select the gateways to which each exception applies.

Deployment Dashboard

The Deployment Dashboard lets you gradually deploy Threat Prevention policy in your networks. The Deployment Dashboard includes three protection modes: No Protection, Detect Only and According to Profile.

According to profile - The settings of the Threat Prevention profile apply to the object. By default any traffic is protected according to Profile and this is the recommendation. If gradual deployment is needed, you can put specific network objects in "Detect only". We recommend to move these object to According to Profile after a short trial period.

No Protection - The object is not protected by the selected Threat Prevention profile. Traffic is allowed and is not logged.

Detect only - Traffic is allowed, but it is logged according to the Threat Prevention profile settings.

Note - You can easily drag and drop objects from any of the protection modes to any other protection mode

By default, the No Protection and Detect Only columns are empty, and the According to Profile column has one object: Any. When you add an object to the No Protection column or the Detect Only column, the object in the According to Profile column changes from Any to All Other.

File Protections

In the File Protections page, you can:

  • View the protected file types and protection types for the selected Infinity Threat Prevention profile.

  • Override the recommended file protections according to profile and select different protections.

To configure file protections

  1. Go to Threat Prevention > Infinity Threat Prevention > File Protections

  2. Click on the + sign and configure the required protection.

    These are the available protections:

    • Inspect - These technologies are operated: File Reputation, ThreatCloud and Sandbox. You can see Sandbox is enabled in the Sandbox column.

    • Inspect & Clean - These technologies are operated: File Reputation, ThreatCloud, Sandbox and Sanitization (CDR). You can see Sandbox is enabled in the Sandbox column..

    • Block - Block the file.

    • Bypass - Do not inspect the file.

    You cannot override the protections for file types which are not on the list. File types which are not on the list will be inspected in all profiles.