Threat Prevention Profiles

Introducing Profiles

Check Point Threat Prevention provides instant protection based on pre-defined Threat Prevention Profiles. You can also configure a custom Threat Prevention profile to give the exact level of protection that the organization needs.

When you install a Threat Prevention policy on the Security Gateways, they immediately begin to enforce IPS Software Blade on a Check Point Firewall that inspects and analyzes packets and data for numerous types of risks (Intrusion Prevention System). protection on network traffic.

A Threat Prevention profile determines which protections are activated, and which Software Blades are enabled for the specified rule Set of traffic parameters and other conditions in a Rule Base (Security Policy) that cause specified actions to be taken for a communication session. or policy.

A Threat Prevention profile applies to one or more of the Threat Prevention Software Blades: IPS, Anti-Bot Software Blade on a Check Point Firewall that blocks botnet behavior and communication to Command and Control (C&C) centers. Acronyms: AB, ABOT. & Advanced DNS, Anti-Virus Software Blade on a Check Point Firewall that uses real-time virus signatures and anomaly-based protections from ThreatCloud to detect and block malware at the Check Point Firewall before users are affected. Acronym: AV., Threat Emulation Software Blade on a Check Point Firewall that monitors the behavior of files in a sandbox to determine whether or not they are malicious. Acronym: TE., Threat Extraction Software Blade on a Check Point Firewall that removes malicious content from files. Acronym: TEX. and Zero Phishing Software Blade on a Check Point Firewall (R81.20 and higher) that provides real-time phishing prevention based on URLs. Acronym: ZPH..

Without profiles, it would be necessary to configure separate rules for different activation settings and confidence levels. With profiles, you get customization and efficiency.

SmartConsole includes these default Threat Prevention profiles

Profile	Description
Optimized	Provides excellent protection for common network products and protocols against recent or popular attacks
Strict	Provides a wide coverage for all products and protocols, with impact on network performance
Basic	Provides reliable protection on a range of non-HTTP protocols for servers, with minimum impact on network performance

Optimized Protection Profile Settings

The Optimized profile is activated by default, as it provides excellent security while maintaining good Security Gateway performance.

These are the goals of the Optimized profile, and the settings that achieve those goals

Goal	Parameter	Setting
Apply settings to all the Threat Prevention Software Blades	Blades Activation	Activate the profile for IPS, Anti-Bot & Advanced DNS, Anti-Virus, Threat Emulation, Threat Extraction and Zero Phishing.
Do not have a critical effect on performance	Performance impact	Activate protections that have a Medium or lower effect on performance.
Protect against important threats	Severity	Protect against threats with a severity of Medium or above.
Reduce false-positives	Confidence	Set to Prevent UserCheck rule action that blocks traffic and files and can show a UserCheck message. the protections with an attack confidence of Medium or High. Set to Detect the protections with a confidence of Low.

Profiles Pane

The pane shows a list of profiles that were created, their confidence levels, and performance impact settings.

The Profiles pane contains these options

Option	Meaning
New	Creates a new profile.
View	Shows an existing profile.
Edit	Modifies an existing profile.
Clone	Creates a copy of an existing profile.
Delete	Deletes a profile.
Where Used	Shows you reference information for the profile.
Search	Searches for a profile.
Last Modified	Shows who last modified the selected profile, when and on which client.

Performance Impact

Performance impact is how much a protection affects a Security Gateway's performance. Some activated protections may negatively impact connectivity or overall performance. You can configure the Threat Prevention policy so that protections with high performance impact are not set to Prevent or Detect.

Severity

Severity of the threat. Probable damage of a successful attack to your environment.

Activation Settings

Setting	Description
Ask	The Software Blade blocks the file or traffic until the user makes sure that the Security Gateway should send it. The user decides if the file or traffic are allowed or not. The decision itself is logged in the User Response field in the Ask UserCheck rule action that blocks traffic and files and shows a UserCheck message. The user can agree to allow the activity. User log.
Prevent	The Software Blade blocks the file or traffic from passing through the Security Gateway. It also logs the traffic, or tracks it, according to configured settings in the Rule Base All rules configured in a given Security Policy. Synonym: Rulebase..
Detect	The Software Blade allows identified file or traffic to pass through the Security Gateway. It also logs the traffic, or tracks it, according to configured settings in the Rule Base.
Inactive	The Software Blade deactivates a protection.

Confidence Level

The confidence level is how confident the Software Blade is that recognized attacks are actually virus or bot traffic. Some attack types are more subtle than others and legitimate traffic can sometimes be mistakenly recognized as a threat. The confidence level value shows how well protections can correctly recognize a specified attack.

Creating Profiles

You can choose from multiple pre-configured Profiles, but not change them. You can create a new profile or clone a profile. When you create a new profile, it includes all the Threat Prevention Software Blades by default.

When HTTPS inspection is enabled on Security Gateway, Threat Emulation, Anti-Bot & Advanced DNS, and Anti-Virus can analyze the applicable HTTPS traffic.

To create a new Threat Prevention profile

Step	Instructions
1	In SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on., select Security Policies > Threat Prevention.
2	From the Custom Policy Tools section, click Profiles. The Profiles page opens.
3	Right-click a profile and select New.
4	Configure the settings for the profile.
5	Click OK.
6	Install the Threat Prevention policy.

Cloning Profiles

You can create a clone of a selected profile and then make changes. You cannot change the out-of-the-box profiles: Basic, Optimized, and Strict.

To clone a Threat Prevention profile

Step	Instructions
1	In SmartConsole, select Security Policies > Threat Prevention.
2	From the Custom Policy Tools section, click Profiles. The Profiles page opens.
3	Right-click the profile and select Clone.
4	The Name field shows the name of the copied profile plus _copy.
5	Rename the profile.
6	Click OK.
7	Publish the SmartConsole session.

Editing Profiles

You can change the settings of the Threat Prevention profile according to your requirements.

To edit a profile

Step

Instructions

In SmartConsole, select Security Policies > Threat Prevention.

From the Custom Policy Tools section, click Profiles.

The Profiles page opens.

Right-click the profile and select Edit.

Deleting Threat Prevention Profiles

You can delete a profile, but you cannot delete the default Threat Prevention profiles.

To delete a profile

Step	Instructions
1	In SmartConsole, select Security Policies > Threat Prevention.
2	From the Custom Policy Tools section, click Profiles. The Profiles page opens.
3	Right-click the profile, and click Delete. A window opens and shows a confirmation message.
4	Click Yes. If the profile is used by another object, you cannot delete it. The error message is shown in the Tasks window.
5	In SmartConsole, install the policy.

To show the objects that use a profile

Step	Instructions
1	From the Profiles page, select the profile. The Summary page opens.
2	From the Where Used section in the Summary tab, click Where Used. The Where Used window opens and shows the profile.
3	Right-click the rule and select View in policy.

Step

Instructions

From the Profiles page, select the profile.

The Summary page opens.

From the Where Used section in the Summary tab, click Where Used.

The Where Used window opens and shows the profile.

Right-click the rule and select View in policy.

Viewing Changes to a Threat Prevention Profile

You can view the Audit log and see changes that were made to a Threat Prevention profile.

To view the Audit log for a Threat Prevention profile

Step	Instructions
1	In SmartConsole, click Logs & Events.
2	Click the Audit tab, or press CTRL + T, and then click Open Audit Logs View.
3	In Enter search query, enter the name of the profile.
4	To refine the search: Right-click the Object Type column heading and select Add Filter. Enter Threat Prevention Profile. Click the filter to add it to the search. Click OK. The search results are filtered to Threat Prevention profiles.
5	To see more information about the changes to a profile, double-click the Audit log.