Threat Prevention Policy Optimization

[Ihenock1011]

Hi All,

I have a Check Point Security Gateway R81.10 with Threat Prevention enabled, and the Threat Prevention policy is currently in detect mode. After a learning stage of 15 days, I intend to change the policy to prevent mode. Additionally, I need guidance on how to optimize the threat prevention settings according to best practices.

Thanks

[Lesley]

What blades are you planning to enable in Threat Prevention?

[the_rock]

Personally, what I always say to people is to simply set the policy to optimize profile, as that is the CP recommended one anyway. If any issues down the road, you can always create exceptions in the policy.

Best,

Andy

[PhoneBoy]

Most of the optimization comes around eliminating false positives and/or performance related concerns, which are environment dependent.
However, starting with the Optimized TP policy is generally a safe bet.

[Timothy_Hall]

Yes Optimized is always a good profile to start with.  Another strong recommendation is to create Global Exceptions as opposed to rule-based exceptions to facilitate the transition to Autonomous Threat Prevention should you want to go there in the future.  When exceptions are created directly from the log card of a Threat Prevention log they are always created as rule-based exceptions.  Found out the hard way that if you enable Autonomous Threat Prevention (ATP), rule-based exceptions suddenly stop working and only Global Exceptions apply.  Really should be some kind of warning about this when enabling ATP if rule-based exceptions are present.

[the_rock]

Excellent explanation, as always.