Best Practice - Signature Update

[Fabz]

Hi Checkmate,

Is there a best practice document for determining update interval for threat prevention database and appcontrol database?

example

Is the default time interval on the smart console in accordance with best practice?

I currently have the issue of high bandwidth towards *.checkpoint.com

Any impact if i change the deafult time interval to let say every midnight? since i got asked from operational team why CP has a lot query to CP domains. Merci!

[_Val_]

IPS/AB updates should not consume much bandwidth, even if done every second hour.

Are you sure this is because of your management side updates and NOT the actual communication to Threat Cloud from your GWs?

[Fabz]

yes we have some query from our GWs, is this due to communication with Threat Cloud? why directly to GWs not via management?

and also i have policy to block communication to several domain, manually in policy. but i think this is not related with high bandwidth utilization.

[_Val_ · Accepted solution]

As part of Threat Prevention, your GWs are using live communications with Threat Cloud for Anti-Bot live data, URL filtering, Applicaiton control and AVI, if any. These live updates allow us to provide you with immediate protection from recently discovered attacks.

On top, there are other communications Check Point security systems, both MGMT and GWs, may need. Please look into sk83520 for more details.

[PhoneBoy · Accepted solution]

It is expected behavior for gateways to reach out to various checkpoint.com addresses, particularly if you are using URL Filtering or any of the Threat Prevention features.
We document the specific locations here: https://support.checkpoint.com/results/sk/sk83520

Increasing/decreasing these signature update intervals are unlikely to change the number of requests the gateway generates, as the requests are in response to real-time traffic received by the gateway.