Autonomous Threat Prevention and Core Protections / Inspection Settings

[Oliver_Matt]

Hi all,

we've switched to the autonomous threat prevention (R81.20) and I was wondering if the "old" IPS settings still apply in any way?

Profiles created / copied from the default Profiles (No-Prevention, Basic, Optimized, Recommended_Protection and Strict) under "Custom Policy" should be completely out of business - right?

Inspection Settings (Shared Policies) are still active and "Recommend Inspection" has to be used as best-practise

But what is with the Core Protections?

The only show up when I switch to the "Custom Policy" section. Since they have been activated in the older days without having IPS enabled I wonder if they are still in use after the switch to autonomous threat prevention?

Kind regards

Oliver

[Tal_Paz-Fridman]

Core Protections - although shown under IPS are part of Access Control Policy and not Threat Prevention Policy.

This means they still apply:

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_ThreatPrevention_AdminGuide/Conten...

See section for Protection Types:

• Core protections - These protections are included in the product and are assigned per gateway. They are part of the Access Control policy

In SmartConsole select Profiles (under Custom Policy Tools) > in the bottom pane press on link to Core Protections

[Oliver_Matt]

Ok - understood. But just to make sure: This is only for the Core Activations specified in the profile. The other profile settings (marked pink) have no impact on the autonomous threat profil?



So it would be possible to create a profile under custom profiles with everything deactivated and only specify the needed settings for the Core Activations?

[Oliver_Matt]

Bump 🙂

[PhoneBoy]

It should not be necessary to define a Threat Prevention profile to manage the settings for the Core Protections as their settings are managed directly.
That's suggested by the tooltip in the screenshot @Tal_Paz-Fridman provided.

[Oliver_Matt]

OK - Got that! I filtered according to the tool tip and was able to see the Core Protections. But still one question remains:

When I view the core protections from one of the old profiles I can see actions according to the profile settings like shown here:

Also when I select the Gateways section I can see a profile attached to my fw-cluster:



So if there is no need to create a profile for the Core Protections -> Can I just delete my custom made profiles and than do what? Will than the "default action" of the Core Protection kick in? This is kind of confusing me 😞

[PhoneBoy]

I will try to get a definitive answer to this question about what happens with Core Protections with ATP.

[Oliver_Matt]

Thank you in advance. Looking forward to the final wisdom 🙂

[Timothy_Hall]

My guess that since Core Protections/Activations and Inspection Settings changes are made effective by installing the Access Control policy (not the Threat Prevention policy which is fully controlled by Autonomous mode), these still operate independently even though Autonomous Threat Prevention (ATP) is enabled.  This is further bolstered by the fact the Core Protections/Activations and Inspection Settings have their own completely independent profile settings, completely separate from the IPS ThreatCloud protections which are controlled by profiles specified in the Threat Prevention policy itself (which ATP takes over).