I'm having a weird Threat Prevention/Emulation problem. In another post I was trying to remove it unsuccessfully (rather, it seemed removed by I kept getting a message to Uninstall Threat Prevetion policy).
So now I'm trying the reverse, leave it enabled in "Autonomous Policy" mode; and I'm seeing some weirdness:
1) AntiBot and AntiVirus look fine
2) IPS was yellow lit but after a MGMT server reboot and re-updating then pushing policy - it went green.
3) Threat Emulation --> Says '2 gateways are up to date' and is green-lit
However, if you click on More Details it says: 'Threat Emulation is inactive'
Is #3 expected?!
Things I've done:
1) Ensured MGMT and GW's have internet access and can curl checkpoint addresses.
2) tecli cache clean and tecli download commands to update Threat emulation
3) Rebooting MGMT server
4) Repushing policy (obviously)
5) Ensuring SIC Test comes back with "Communicating"
