IPS Protection Update

[Murad_Elmgbar]

Can Checkpoint add a new feature that will allow for customers to download custom cve's files from different vendors to match the customers infrastructure and equipment? Currently, Checkpoint pushed new cve's but many of them do not match our needs. is it possible in near future to offer this feature.

[PhoneBoy · Accepted solution]

By custom CVE, I assume you mean a custom signature to address a specific CVE.
We've allowed customers to import snort signatures for several versions now.

[Murad_Elmgbar]

I know we can add snort rules but not signatures, do you have any document showing how to import snort signatures into IPS protection.

Thanks

[PhoneBoy]

Aren't snort signatures just a series of snort rules?
In any case, this should be covered in the Threat Prevention docs.
For R80.30: https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_ThreatPrevention_AdminGuide/...

[Murad_Elmgbar]

Gotcha!