Configuring Threat Prevention Blade Control

In the Threat Prevention > Threat Prevention Blade Control page you can activate:

  • Intrusion Prevention System (IPS). Blocks potentially malicious attempts to exploit known vulnerabilities in files and network protocols.

  • Anti-Virus. Blocks potentially malicious files that are infected with viruses.

  • Anti-Bot. Detects bots, prevents communication between the bot and its Command & Control center, and gives threat visibility. A bot is malicious software that can infect your computer with malware. A bot infected device can then be used by a Command & Control server to execute different types of attacks (send out SPAM messages or Denial-of-Service attacks against web sites). There are many infection methods. These include if you open attachments that exploit a vulnerability or access a web site that results in a malicious download.

  • Threat Emulation. Gives networks protection against unknown threats in files that are downloaded from the Internet or attached to emails. In emulation, the file is opened on more than one virtual computer with different operating system environments. These virtual computers are closely monitored for unusual and malicious behavior. Any malicious behavior is immediately logged and you can use PreventClosed UserCheck rule action that blocks traffic and files and can show a UserCheck message. mode to block the file from the internal network. Information about malicious files is shared with Check Point ThreatCloud.

You configure all the settings for these blades in the same place and set a single profile for all of them.

Enabling and Disabling Threat Prevention

Move the slider to ON or OFF.

Enabling Threat Emulation Policy for the FTP Protocol

Note - In the R81.10.X releases, this feature is available starting from the R81.10.05 version.

Move both the Anti-VirusClosed Check Point Software Blade on a Security Gateway that uses real-time virus signatures and anomaly-based protections from ThreatCloud to detect and block malware at the Security Gateway before users are affected. Acronym: AV. and Threat EmulationClosed Check Point Software Blade on a Security Gateway that monitors the behavior of files in a sandbox to determine whether or not they are malicious. Acronym: TE. sliders to ON.

Note - When the blade is managed by Cloud Services, a lock icon appears. You cannot toggle between the "ON" and "OFF" states. If you change other policy settings, the change is temporary. Any changes made locally are overridden in the next synchronization between the gateway and Cloud Services.

The update status is displayed next to each blade:

  • Up to date

  • Update available

  • Update service unreachable

You can activate the blades to prevent attacks/infection or set them to detect-mode only on the Threat Prevention Engine Settings page.

A warning message shows if a blade is in configured in the DetectClosed UserCheck rule action that allows traffic and files to enter the internal network and logs them.-only mode.

The top of the page shows the number of infected devices. For more information, click More details.

One policy is configured for all the blades:

Configuring a Custom Policy for Threat Prevention

  1. In the Threat Prevention Blade Control page, under Policy, select Custom.

  2. For Tracking options, select one of these options:

    • None – Do not log.

    • Log – Create a log.

    • Alert – Log with an alert.

  3. Under Protection Activation, for each confidence level (High confidence, Medium confidence, and Low confidence), select the applicable action from the list:

    • Ask - Traffic is blocked until the user confirms it is allowed.

    • Prevent - Blocks identified virus or bot traffic, or identified malicious files, from passing through the gateway.

    • Detect - Allows identified virus or bot traffic, or identified malicious files, to pass through the gateway. This traffic is detected and logged.

    • Inactive - The protection is deactivated.

  4. For Severity, select the level:

    • Low or above

    • Medium or above

    • High or above

    • Critical

  5. For Performance impact, select the allowed impact level:

    • Low

    • Medium or lower

    • High or lower

  6. To load the policy default values, click Load default settings:

    • Recommended

    • Strict

  7. To save all settings on the Threat Prevention Blade Control page, click Apply.

Scheduling Threat Prevention Updates

  1. Click Schedule.

    The Activate Automatic Updates window opens.

  2. Select the Software Blades to receive automatic updates:

  3. Select the Recurrence and Time of day.

  4. Click Apply