Managing Threat Prevention
R81.10.X Quantum Spark 1500, 1600, 1800, 1900, 2000 Appliances Locally Managed Administration Guide|277
Managing Threat Prevention
This section describes how to set up and manage the Intrusion Prevention System (IPS), Anti-
Virus, Anti-Bot, Threat Emulation, and Anti-Spam blades.
Configuring Threat Prevention Blade Control
In the Threat Prevention > Threat Prevention Blade Control page you can activate:
n
Intrusion Prevention System (IPS). Blocks potentially malicious attempts to exploit
known vulnerabilities in files and network protocols.
n
Anti-Virus. Blocks potentially malicious files that are infected with viruses.
n
Anti-Bot. Detects bots, prevents communication between the bot and its Command &
Control center, and gives threat visibility. A
bot
is malicious software that can infect your
computer with malware. A bot infected device can then be used by a Command &
Control server to execute different types of attacks (send out SPAM messages or Denial-
of-Service attacks against web sites). There are many infection methods. These include
if you open attachments that exploit a vulnerability or access a web site that results in a
malicious download.
n
Threat Emulation. Gives networks protection against unknown threats in files that are
downloaded from the Internet or attached to emails. In emulation, the file is opened on
more than one virtual computer with different operating system environments. These
virtual computers are closely monitored for unusual and malicious behavior. Any
malicious behavior is immediately logged and you can use Prevent mode to block the file
from the internal network. Information about malicious files is shared with Check Point
ThreatCloud.
You configure all the settings for these blades in the same place and set a single profile for all
of them.
Enabling and Disabling Threat Prevention
Move the slider to ON or OFF.
To Next Page
Loading...
