The easiest way to deactivate large numbers of signatures is by using tags in R80+ management and later. You can explicitly activate all signatures tagged with a certain vendor or product then deactivate everything else. I've attached a screenshot from my IPS Immersion course showing where that screen is located. IPS activation/deactivation tags will work with R77.XX gateways as well.
In R80.20+ management/gateway you could definitely "forget" about updating a profile as the gateway can automatically download and activate Protections matching your tagged (or other) criteria.
In regards to best practices for using multiple IPS Profiles on a single gateway/cluster, I tend to look at it from a gateway performance perspective, but I'm probably a bit biased in my view. 🙂 Example:
Protected Scope: DMZ_Group IPS Profile: Strict (or some customized clone thereof)
Protected Scope: Sensitive_Networks_Group IPS Profile: Optimized (or some customized clone thereof)
Protected Scope: All_Internal_Networks_Group IPS Profile: Basic (or some very relaxed clone thereof)
Since trouble is most likely to start in a DMZ I'd want max enforcement there, even for vendors/products not in use in the network. Needless to say picking up a bunch of attempted attacks from inside the DMZ against vendors/products you don't even have is a sure sign of compromise. For sensitive internal networks, this traffic will tend to be high-speed LAN traffic so we'd want a medium amount of inspection. For everything else perhaps a bit more relaxed (Basic) but still picking up anything flagrantly indicating signs of compromise.
![tags.jpg tags.jpg](https://community.checkpoint.com/t5/image/serverpage/image-id/536i88AF90F05DED06F1/image-size/large?v=v2&px=999)
Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com