topic Re: Security Logs in General Topics

Security Logs

Samphas1 — Fri, 03 Feb 2023 01:09:38 GMT

Hi CP,

I'm concerning with the logs between Attack Allowed by Policy and Prevented Attacked. Could you please explain me how are different ?

Re: Security Logs

Chris_Atkinson — Fri, 03 Feb 2023 02:23:28 GMT

The above will typically correspond with events who's action is Detect vs Prevent.

Often this is a configuration/policy decision on the part of the administrator for blades or protections.

Re: Security Logs

Samphas1 — Fri, 03 Feb 2023 03:03:58 GMT

Hi @Chris_Atkinson If the action is Detect it mean we allow the connection came into the environment ? And there is any impact or high risk with this action ?

Re: Security Logs

the_rock — Fri, 03 Feb 2023 03:17:27 GMT

I agree with Chris. If you look at the top and what it says there, it indicates "attacks allowed by policy", so definitely referring to detect vs prevent.

Re: Security Logs

Samphas1 — Fri, 03 Feb 2023 03:35:19 GMT

Hi @the_rock ,

If the "Attacks allowed by policy " what will impact to the environment ?

Re: Security Logs

PhoneBoy — Fri, 03 Feb 2023 06:39:11 GMT

The Detect action means: it was allowed into the environment due to the specific Threat Prevention profile configuration.
The precise risk depends on what it was that was detected.
A Prevent or Block means it was prevented.

Re: Security Logs

Chris_Atkinson — Fri, 03 Feb 2023 06:49:22 GMT

As @PhoneBoy indicated it depends on the specific configuration and the event that was detected.

For example the "Strict" TP profile versus "Optimized" each have different criteria based on confidence/impact/severity and enabled blades.

The objective here is to achieve a balance between security/performance/false positives relative to your environment and what assets you are protecting.

Re: Security Logs

Samphas1 — Fri, 03 Feb 2023 07:47:14 GMT

If the change all policy to prevent type what it will impact or not ? And what is the best practice and recommendation ?

Re: Security Logs

Chris_Atkinson — Fri, 03 Feb 2023 14:58:25 GMT

Generalization: Prevent catch-rate will increase at the expense of performance (particularly if you adjust the active protection parameters or enable additional blades).

Optimized profile is typically a good place to start then you can clone and tune it further per your own requirements.

Re: Security Logs

G_W_Albrecht — Fri, 03 Feb 2023 14:20:40 GMT

If the protection is on Detect already, Prevent will not cost more performance. I tend to use inactive for low confidence instead of detect...

Re: Security Logs

PhoneBoy — Fri, 03 Feb 2023 18:57:58 GMT

From a "work" standpoint, Prevent and Detect require the same amount of work.
Detect ultimately still allows the traffic, which means it still continues to process the traffic.
That means Detect could actually end up requiring more work in the end...

Re: Security Logs

Timothy_Hall — Sat, 04 Feb 2023 15:58:07 GMT

Yep Detect causes more overhead than Prevent, and in some cases much more. Here is an excerpt from my new R81.20 Gateway Performance Optimization 2-day course discussing this topic:

Re: Security Logs

the_rock — Fri, 03 Feb 2023 20:23:34 GMT

You definitely got all the logical answers, so I would stick with optimized profile as Chris said, cant go wrong.

Re: Security Logs

Samphas1 — Mon, 06 Feb 2023 02:26:52 GMT

Could you please explain me more how are different between the Optimized and Strict Action ?

Re: Security Logs

Chris_Atkinson — Mon, 06 Feb 2023 02:44:59 GMT

More protections will be active in the "Strict" profile.

Re: Security Logs

Samphas1 — Mon, 06 Feb 2023 03:17:51 GMT

The screenshot below action is Detect mean that Anti-Virus software blade not protection and allow the connection. Am I right ?

Re: Security Logs

Samphas1 — Mon, 06 Feb 2023 03:19:35 GMT

* Update picture for last previous question.

Re: Security Logs

Chris_Atkinson — Mon, 06 Feb 2023 04:54:42 GMT

Detect in this context means it was obsevered and not prevented based on the profile settings.

Please expand one of the line/log entries and we can help explain it better for you.

(Mask / redact sensitive parts as required).

Re: Security Logs

Samphas1 — Mon, 06 Feb 2023 06:54:00 GMT

Hi @Chris_Atkinson ,

Could you please check the detail log below picture and help explain .

Re: Security Logs

G_W_Albrecht — Mon, 06 Feb 2023 07:35:57 GMT

Reason is that you enabled background classification mode, see sk74120. But this SK is not found...