What frequency to CWS

[r31N3r]

Hello,

Can me anyone tell what is the correct frequency  a cluster-(ip) should connect to  http://cws.checkpoint.com/Malware/malware/6.0?  or  http://cws.checkpoint.com/AntiVirus/antivirus/2.0? ?  In our environment , AV and Antibot enabled, it seems to be a streaming connection. Is this O.K.?

Thank you for your replies in advance

Reiner

[the_rock]

Might be worth TAC case to confirm this...excellent question by the way @r31N3r 

[G_W_Albrecht]

Confirm what ? He did not present any answer that can be confirmed, but only a question still not answered by anyone 😉

I would  go for 12h.

[the_rock]

Confirm answer to his question 😇

[G_W_Albrecht]

What do you mean by frequency ? How often per week / day you connect and update  ? This can be selected according to your prefered interval. sk83520 - How to verify that Security Gateway and/or Security Management Server can access Check Poi...

[r31N3r]

We set in the SmartDashboard "Traditional Anti-Virus"  120min and "Proxy1".

On "Proxy 2", set in Global Properties or in Custer Object, the log for cws.checkpoint.com is running like there's no tomorrow.  All states IPS/AV Signature on for the cluster are "green".

[_Val_ · Accepted solution]

This is normal, AV/AB/IPS are in constant communication with the ThreatCloud. 

[PhoneBoy · Accepted solution]

If AV/AB are enabled, calls to those URLs and others listed in sk83520 are to be expected relative to the traffic the gateway is seeing.
It's expected behavior.