topic Re: Best Practice - Signature Update in Firewall and Security Management

Best Practice - Signature Update

Fabz — Mon, 05 Jun 2023 09:36:11 GMT

Hi Checkmate,

Is there a best practice document for determining update interval for threat prevention database and appcontrol database?

example

Is the default time interval on the smart console in accordance with best practice?

I currently have the issue of high bandwidth towards *.checkpoint.com

Any impact if i change the deafult time interval to let say every midnight? since i got asked from operational team why CP has a lot query to CP domains. Merci!

Re: Best Practice - Signature Update

_Val_ — Mon, 05 Jun 2023 10:05:40 GMT

IPS/AB updates should not consume much bandwidth, even if done every second hour.

Are you sure this is because of your management side updates and NOT the actual communication to Threat Cloud from your GWs?

Re: Best Practice - Signature Update

Fabz — Mon, 05 Jun 2023 10:55:08 GMT

yes we have some query from our GWs, is this due to communication with Threat Cloud? why directly to GWs not via management?

and also i have policy to block communication to several domain, manually in policy. but i think this is not related with high bandwidth utilization.

Re: Best Practice - Signature Update

_Val_ — Mon, 05 Jun 2023 12:19:56 GMT

As part of Threat Prevention, your GWs are using live communications with Threat Cloud for Anti-Bot live data, URL filtering, Applicaiton control and AVI, if any. These live updates allow us to provide you with immediate protection from recently discovered attacks.

On top, there are other communications Check Point security systems, both MGMT and GWs, may need. Please look into sk83520 for more details.

Re: Best Practice - Signature Update

PhoneBoy — Mon, 05 Jun 2023 16:45:02 GMT

It is expected behavior for gateways to reach out to various checkpoint.com addresses, particularly if you are using URL Filtering or any of the Threat Prevention features.
We document the specific locations here: https://support.checkpoint.com/results/sk/sk83520

Increasing/decreasing these signature update intervals are unlikely to change the number of requests the gateway generates, as the requests are in response to real-time traffic received by the gateway.