Migration to Autonomous Threat Prevention

[Sorin_Gogean]

Hello everyone,

We are currently using Threat Prevention with specific policies as per our environment.

In order to reduce the workload and improve the adoption speed of the new protections, we were thinking to adopt the Autonomous Threat Prevention .

If you have a recommendation on this step(s), would be appreciated 😊 .

Now the first question we have, is in regards to the Exceptions we currently have. As per our understanding, the Global Exceptions will remain, as for specific Exceptions that we have per IPS/Threat Policies, those will have to be moved either to the new Autonomous Policy or to Global Exception one.

Secondly, in regards to different IPS protections (and not only those) that our Cyber Security Team had enabled, what would be the easiest way to export the ACTIVE protections from current policies, so we can compare with the Autonomous active ones, as CyberSec might go that path and state that they would enable certain protections with or without any actual reason (don't ask 😊)

Any other hint we should pay attention to ?

Thank you,

[G_W_Albrecht · Accepted solution]

sk163593: Autonomous Threat Prevention Management

sk169952: ATRG - Autonomous Threat Prevention

sk167109: Autonomous Threat Prevention Management integration Release Updates

[Sorin_Gogean]

thank you @G_W_Albrecht , I was following the sk163593 and sk167109 but didn't seen yet the sk169952 .

So I'll go over that and see if we'll clarify our questions or others arise 🙂.

thank you,

[Timothy_Hall]

Here are some of the pages covering Autonomous Threat Prevention in my IPS/AV/ABOT Immersion course you may find helpful, the pages below have been updated slightly from the R80.40 version of the document available for purchase at the moment.