Managing Threat Prevention
Quantum Spark 1500, 1600 and 1800 Appliance Series R80.20.25 Locally Managed Administration Guide | 187
Managing Threat Prevention
This section describes how to set up and manage the Intrusion Prevention System (IPS), Anti-Virus, Anti-
Bot, Threat Emulation, and Anti-Spam blades.
Configuring Threat Prevention Blade Control
In the
Threat Prevention
>
Threat Prevention Blade Control
page you can activate:
n
Intrusion Prevention System (IPS)
. Blocks potentially malicious attempts to exploit known
vulnerabilities in files and network protocols.
n
Anti-Virus
. Blocks potentially malicious files that are infected with viruses.
n
Anti-Bot
. Detects bots, prevents communication between the bot and its Command & Control
center, and gives threat visibility. A
bot
is malicious software that can infect your computer with
malware. A bot infected device can then be used by a Command & Control server to execute
different types of attacks (send out SPAM messages or Denial-of-Service attacks against web sites).
There are many infection methods. These include if you open attachments that exploit a
vulnerability or access a web site that results in a malicious download.
n
Threat Emulation
. Gives networks protection against unknown threats in files that are downloaded
from the Internet or attached to emails. In emulation, the file is opened on more than one virtual
computer with different operating system environments. These virtual computers are closely
monitored for unusual and malicious behavior. Any malicious behavior is immediately logged and
you can use Prevent mode to block the file from the internal network. Information about malicious
files is shared with Check Point ThreatCloud.
You configure all the settings for these blades in the same place and set a single profile for all of them.
To enable or disable Threat Prevention:
Move the slider.
Note
- When the blade is managed by Cloud Services, a lock icon is shown. You cannot toggle between the
on and off states. If you change other policy settings, the change is temporary. Any changes made locally
are overridden in the next synchronization between the gateway and Cloud Services.
The update status is displayed next to each blade:
n
Up to date
n
Update available
n
Update service unreachable
You can activate the blades to prevent attacks/infection or set them to detect-mode only on the
Threat
Prevention Engine Settings
page. A warning message shows if a blade is in detect-only mode.
The top of the page shows the number of infected devices. For more information, click
More details.
