Check Point R80.20 - Fw Sam_Policy and Fw6 Sam_Policy

Command Line Reference
Next Generation Security Gateway Guide R80.20 | 484
'fw sam_policy' and 'fw6 sam_policy'
Description
Manages the Suspicious Activity Policy editor that lets you work with these types of rules:
• Suspicious Activity Monitoring (SAM) rules.
See sk112061: How to create and view Suspicious Activity Monitoring (SAM) Rules
http://supportcontent.checkpoint.com/solutions?id=sk112061.
• Rate Limiting rules.
See sk112454: How to configure Rate Limiting rules for DoS Mitigation
http://supportcontent.checkpoint.com/solutions?id=sk112454.
Also, see these commands:
• fw sam (on page 477)
• sam_alert (on page 541)
Notes:
• You can run these commands interchangeably: 'fw sam_policy' and 'fw samp'.
• Security Gateway stores the SAM Policy rules in the $FWDIR/database/sam_policy.db
file.
• The SAM Policy management file is $FWDIR/database/sam_policy.mng.
• You can run these commands in Gaia Clish, or Expert mode.
Important:
• Configuration you make with these commands, survives reboot.
• VSX Gateway does not support Suspicious Activity Policy configured in SmartView Monitor. See
sk79700 http://supportcontent.checkpoint.com/solutions?id=sk79700.
• The SAM Policy rules consume some CPU resources on Security Gateway. We recommend to
set an expiration that gives you time to investigate, but does not affect performance. The best
practice is to keep only the SAM Policy rules that you need. If you confirm that an activity is
risky, edit the Security Policy, educate users, or otherwise handle the risk.
• On VSX Gateway, first go to the context of an applicable Virtual System.
In Gaia Clish, run: set virtual-system <
VSID >
In Expert mode, run: vsenv <
VSID >
• In Cluster, you must configure the SecureXL in the same way on all the Cluster Members.
Syntax for IPv4
fw [-d] sam_policy
add <options>
batch
del <options>
get <
options
>
fw [-d] samp
add <options>
batch
del <options>
get <options>