topic Zero Phishing is set to Prevent mode but Detect in logs in Endpoint https://community.checkpoint.com/t5/Endpoint/Zero-Phishing-is-set-to-Prevent-mode-but-Detect-in-logs/m-p/215056#M8736 <P>Hi everyone!</P><P>Can someone please help me, I'm just wondering why in the logs the action for Zero Phishing blade is Detect. But upon checking the policy, it is set to Prevent mode. See attached screenshots.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Logs Detect.png" style="width: 204px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/25844i35E2E67F0EDCB73B/image-size/medium?v=v2&amp;px=400" role="button" title="Logs Detect.png" alt="Logs Detect.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Policy Prevent.png" style="width: 400px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/25843iC1865F604A9D8E64/image-size/medium?v=v2&amp;px=400" role="button" title="Policy Prevent.png" alt="Policy Prevent.png" /></span></P><P>Why is it different? It should be Prevent in the logs as well right? Does anyone of you experienced this or am I missing out on something? Kind of a newbie in HEP <span class="lia-unicode-emoji" title=":grinning_face_with_smiling_eyes:">😄</span></P> Thu, 23 May 2024 03:22:19 GMT 62742738 2024-05-23T03:22:19Z Zero Phishing is set to Prevent mode but Detect in logs https://community.checkpoint.com/t5/Endpoint/Zero-Phishing-is-set-to-Prevent-mode-but-Detect-in-logs/m-p/215056#M8736 <P>Hi everyone!</P><P>Can someone please help me, I'm just wondering why in the logs the action for Zero Phishing blade is Detect. But upon checking the policy, it is set to Prevent mode. See attached screenshots.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Logs Detect.png" style="width: 204px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/25844i35E2E67F0EDCB73B/image-size/medium?v=v2&amp;px=400" role="button" title="Logs Detect.png" alt="Logs Detect.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Policy Prevent.png" style="width: 400px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/25843iC1865F604A9D8E64/image-size/medium?v=v2&amp;px=400" role="button" title="Policy Prevent.png" alt="Policy Prevent.png" /></span></P><P>Why is it different? It should be Prevent in the logs as well right? Does anyone of you experienced this or am I missing out on something? Kind of a newbie in HEP <span class="lia-unicode-emoji" title=":grinning_face_with_smiling_eyes:">😄</span></P> Thu, 23 May 2024 03:22:19 GMT https://community.checkpoint.com/t5/Endpoint/Zero-Phishing-is-set-to-Prevent-mode-but-Detect-in-logs/m-p/215056#M8736 62742738 2024-05-23T03:22:19Z Re: Zero Phishing is set to Prevent mode but Detect in logs https://community.checkpoint.com/t5/Endpoint/Zero-Phishing-is-set-to-Prevent-mode-but-Detect-in-logs/m-p/215059#M8738 <P>Hey,</P> <P>Are all your rules set to prevent for zero phishing and password reuse?&nbsp;</P> <P>When you start with HEP the default policy is set to Detect, is it possible that on of the rules is still in detect mode?</P> Thu, 23 May 2024 04:09:17 GMT https://community.checkpoint.com/t5/Endpoint/Zero-Phishing-is-set-to-Prevent-mode-but-Detect-in-logs/m-p/215059#M8738 AdiGH 2024-05-23T04:09:17Z Re: Zero Phishing is set to Prevent mode but Detect in logs https://community.checkpoint.com/t5/Endpoint/Zero-Phishing-is-set-to-Prevent-mode-but-Detect-in-logs/m-p/215060#M8739 <P>Yes, it is all in prevent mode. Even the default one is changed to Prevent mode.</P> Thu, 23 May 2024 04:39:57 GMT https://community.checkpoint.com/t5/Endpoint/Zero-Phishing-is-set-to-Prevent-mode-but-Detect-in-logs/m-p/215060#M8739 62742738 2024-05-23T04:39:57Z Re: Zero Phishing is set to Prevent mode but Detect in logs https://community.checkpoint.com/t5/Endpoint/Zero-Phishing-is-set-to-Prevent-mode-but-Detect-in-logs/m-p/215063#M8740 <P>I would do quick remote with TAC, Im sure something rudimentary is missing.</P> <P>Best,</P> <P>Andy</P> Thu, 23 May 2024 05:38:11 GMT https://community.checkpoint.com/t5/Endpoint/Zero-Phishing-is-set-to-Prevent-mode-but-Detect-in-logs/m-p/215063#M8740 the_rock 2024-05-23T05:38:11Z Re: Zero Phishing is set to Prevent mode but Detect in logs https://community.checkpoint.com/t5/Endpoint/Zero-Phishing-is-set-to-Prevent-mode-but-Detect-in-logs/m-p/215086#M8741 <P>hi&nbsp;</P><P>I checked that my policy is prevented and shows detect for sites with http</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="phishing2.png" style="width: 887px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/25847i73FFAF05B31A3B9C/image-size/large?v=v2&amp;px=999" role="button" title="phishing2.png" alt="phishing2.png" /></span></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="phishing3.png" style="width: 486px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/25848i899333EFF140944D/image-size/large?v=v2&amp;px=999" role="button" title="phishing3.png" alt="phishing3.png" /></span></P><P>All these alerts are http related</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="phishing4.png" style="width: 903px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/25849i8BFB88EBE1866322/image-size/large?v=v2&amp;px=999" role="button" title="phishing4.png" alt="phishing4.png" /></span></P><P>All policies are in preventive mode</P> Thu, 23 May 2024 12:12:45 GMT https://community.checkpoint.com/t5/Endpoint/Zero-Phishing-is-set-to-Prevent-mode-but-Detect-in-logs/m-p/215086#M8741 lluner 2024-05-23T12:12:45Z Re: Zero Phishing is set to Prevent mode but Detect in logs https://community.checkpoint.com/t5/Endpoint/Zero-Phishing-is-set-to-Prevent-mode-but-Detect-in-logs/m-p/215087#M8742 <P>Any exclusions configured?</P> Thu, 23 May 2024 12:21:54 GMT https://community.checkpoint.com/t5/Endpoint/Zero-Phishing-is-set-to-Prevent-mode-but-Detect-in-logs/m-p/215087#M8742 Chris_Atkinson 2024-05-23T12:21:54Z Re: Zero Phishing is set to Prevent mode but Detect in logs https://community.checkpoint.com/t5/Endpoint/Zero-Phishing-is-set-to-Prevent-mode-but-Detect-in-logs/m-p/215088#M8743 <P>Hi , Cris</P><PRE><SPAN class="">For these sites no</SPAN></PRE><P>&nbsp;</P> Thu, 23 May 2024 12:26:26 GMT https://community.checkpoint.com/t5/Endpoint/Zero-Phishing-is-set-to-Prevent-mode-but-Detect-in-logs/m-p/215088#M8743 lluner 2024-05-23T12:26:26Z Re: Zero Phishing is set to Prevent mode but Detect in logs https://community.checkpoint.com/t5/Endpoint/Zero-Phishing-is-set-to-Prevent-mode-but-Detect-in-logs/m-p/215092#M8744 <P>Hello,</P> <P>Those are detect events for sites that were scanned by Zero Phishing. The extension did not recognize them as phishing (which means that the login to them were not prevented) but they were detected to be suspicious because they are http sites with login page.&nbsp;</P> Thu, 23 May 2024 13:08:36 GMT https://community.checkpoint.com/t5/Endpoint/Zero-Phishing-is-set-to-Prevent-mode-but-Detect-in-logs/m-p/215092#M8744 andreyta 2024-05-23T13:08:36Z Re: Zero Phishing is set to Prevent mode but Detect in logs https://community.checkpoint.com/t5/Endpoint/Zero-Phishing-is-set-to-Prevent-mode-but-Detect-in-logs/m-p/215093#M8745 <P>tks.&nbsp;<a href="https://community.checkpoint.com/t5/user/viewprofilepage/user-id/58770">@andreyta</a>&nbsp;</P> Thu, 23 May 2024 13:17:31 GMT https://community.checkpoint.com/t5/Endpoint/Zero-Phishing-is-set-to-Prevent-mode-but-Detect-in-logs/m-p/215093#M8745 lluner 2024-05-23T13:17:31Z