Configuring Autonomous Threat Prevention

To configure Autonomous Threat Prevention in your environment, follow these steps:

  1. Step

    Instructions

    1

    In SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on., go to the Gateways & Servers view, and right-click the required Security GatewayClosed Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources..

    2

    In the General Properties page, go to the Threat Prevention tab, and select Autonomous Threat Prevention

  2. Step

    Instructions

    1

    In SmartConsole, go to Security Policies > Autonomous Threat Prevention > Policy.

    2

    Click the default profile name to see the list of profiles, and select the required profile.

    If you are not sure which profile to select, click the drop-down arrow next to the profile's name, and from the drop-down list, select Help me decide:

    A table which specifies the differences between the profiles opens.

    3

    Based on the table, select the profile which best suits your needs.

    4

    Click OK.

    Note - Each profile shows a list of the technologies that it uses.

  3. Step

    Instructions

    1

    In SmartConsole, from the toolbar, select Install Policy.

    The Install Policy window opens.

    2

    Select Threat Prevention.

    3

    Select the gateway targets for Policy installation.

    Note - The Autonomous Threat Prevention Policy is installed on Security Gateways with Autonomous Threat Prevention enabled. Security Gateways with no Autonomous Threat Prevention enabled receive the Custom Threat Prevention Policy.

    4

    Click Install.

  4. You can use different Autonomous Threat Prevention profiles for different Security Gateways.

    To do so, you must create a new policy package for each Security Gateway and follow the configuration steps, as follows:

    Step

    Instructions

    1

    In SmartConsole, create a new policy package.

    From the main menu, click the drop-down arrow and select Manage policies and layers.

    The Manage policies and layers window opens.

    Click New and configure the new policy package.

    For more information on policy packages, see the R82 Security Management Administration Guide.

    2

    Select the required Autonomous Threat Prevention profile.

    See Create an Autonomous Threat Prevention Policy.

    3

    Install the Threat Prevention policy on the applicable Security Gateway.

    See Install the Autonomous Threat Prevention Policy.

Note - MTA (Mail Transfer AgentClosed Feature on a Security Gateway that intercepts SMTP traffic and forwards it to the applicable inspection component. Acronym: MTA.) is not supported by Autonomous Threat Prevention. You can manage a Security Gateway configured as MTA by Custom Threat Prevention.

Exceptions

Global exceptions are available for use by gateways configured with Autonomous Threat Prevention or a Custom Threat Prevention policy. Global exceptions that existed prior to the migration to Autonomous Threat Prevention are enforced in Autonomous Threat Prevention without any action needed.

To add global exceptions to the Autonomous Threat Prevention policy:

  1. Go to the Security Policies view > Threat Prevention > Exceptions > Global Exceptions.

  2. Add the applicable exceptions.

  3. In the Install On column, select the gateways to which each exception applies.

Deployment

The Deployment Dashboard view:

File Protections

In the File Protections page, you can:

  • View the protected file types and protection types for the selected Autonomous Threat Prevention profile.

  • Override the recommended file protections according to profile and select different protections.

To configure file protections

  1. Go to Threat Prevention > Autonomous Threat Prevention > File Protections

  2. Click on the + sign and configure the required protection.

    These are the available protections:

    You cannot override the protections for file types which are not on the list. File types which are not on the list will be inspected in all profiles.

Settings

Sanitized File Settings

These options are selected by default:

  • Allow end-users to access the original files that are not malicious according to Sandbox - After a file is cleaned/sanitized, a banner with a link to original file is added to the document. An access to original file will be allowed only if the original file is found to be benign by all Threat Prevention engines, including Sandbox. If you clear this option, you will not be able to access the original file even if it is determined as non-malicious.

  • Modify the name of the cleaned file - Select this option to modify the name of the cleaned file.

Advanced Settings

You can override the profile definitions and enable or disable a certain feature or protection, as required. Use this tool to enable or disable DNS protections. We recommend to keep Sandbox, Sanitization and Archives deep scan On.

  1. Click the plus (+) sign.

  2. From the drop-down menu, select the required feature or protection.

  3. Set to On or Off as required.

  4. Click Apply.

  5. Publish your changes.