Threat Prevention

Detecting Threats Across the Open, Deep
and Dark Web With Infinity ERM

Four Ways to SASE

Watch Now

It's Here!
CPX 2025 Content

Get It Now

Remote Access VPN – User Experience
Help us with the Short-Term Roadmap

Take the Survey

CheckMates Go:
What is UPPAK?

LISTEN NOW

Create a Post

RECENT POSTS

MOST POPULAR

FEATURED POSTS

inside

Champion

8500

Identifying server type specific protections

8500

Solved

inside

Explorer

8500

Do I need https inspection to truly benefit from IPS?

8500

inside

Advisor

8500

Bypassing IPS Protections - MySQL

8500

inside

Collaborator

8499

IPS blade generates "General Notice: Internal error" logs

8499

inside

Participant

8499

Maximum file size to scan and action taken in R80.10

8499

Solved

inside

Contributor

8399

Is it possible to block by User Agent or Client Type?

8399

Solved

inside

Contributor

8399

Geo policy

8399

inside

Collaborator

8300

How to prevent TLS1.0 traffic passing through gateway using IPS

8300

inside

Employee

8300

Using Gaia OS curl_cli for Management API commands for Threat Prevention

8300

inside

Collaborator

8299

Threat Emulation Exceptions

8299

inside

Explorer

8299

rss feed of security advisories

8299

Solved

inside

Collaborator

8299

Why does IPS protections set to Prevent show Detect in log?

8299

inside

Collaborator

8199

Performance Impact of Prevent versus Detect with IPS

8199

inside

Participant

8198

R80.10 Security Gatway IPS detects SQLi but not command injection

8198

inside

Contributor

8099

IPS isn't work.

8099

inside

Contributor

7999

Anti-Virus show logs type alert and not prevent traffic

7999

inside

Explorer

7999

Licensing difference - CPLIC Print and smartmonitor expiration date

7999

inside

Contributor

7800

Email MTA setup

7800

inside

Contributor

7799

is it possible to change settings for how application control works?

7799

inside

Participant

7700

Checkpoint Detects "clientservices.googleapis.com" as virus

7700

inside

Admin

7699

Mitre ATT&CK Framework and Check Point TechTalk

7699

Solved

inside

Participant

7699

IPS Geo-Policy Whitelist by Domain Name

7699

inside

Collaborator

7699

Anti-Bot IP Reputation

7699

Solved

inside

Collaborator

7599

IPS Updates for Optimized Profile

7599

inside

Champion

7599

Disable applications requiring HTTPS inspection from being shown as choices.

7599

Solved

inside

Advisor

7499

What is Threat Cloud?

7499

inside

Explorer

7499

TE appliance and AV

7499

Solved

inside

Participant

7399

HTTP Inspection in R80 - HTTP 0.9 Blocked

7399

Solved

inside

Collaborator

7399

Difference IPS and ThreatPrevention

7399

Solved

inside

Collaborator

7399

Error: kfunc_cmik_loader_execute_dyn_ctx

7399

inside

Employee

7399

Understanding the SolarWinds Orion Platform Security Advisory 16-December 2020

7399

inside

Contributor

7300

ERROR WITH THE BLADES

7300

inside

Participant

7300

Postfix - Recipient address rejected

7300

inside

Advisor

7299

Support Renewal Warning on Gateways

7299

inside

Participant

7299

Inspect SSL/TLS on Non-Common Ports

7299

inside

Participant

7299

Checkpoint R80.10 - IPS Logs

7299

inside

Contributor

7199

Event Policy, Legacy

7199

inside

Participant

7199

Automatic Adding of FBI/etc. Thread Indicators

7199

Solved

inside

Contributor

7198

IPS blocks traffic even if the traffic is blocked by Access Policy

7198

inside

Collaborator

7191

AdBlock & IPS - Multiple Websites Mine Cryptocurrencies CPU Hijacking

7191

inside

Contributor

7100

URL Recategorisation

7100

Solved

inside

Participant

7099

IPS Update failed after upgrade from R80.10 to R80.30

7099

inside

Advisor

7099

FTP Bounce prevent instead of inactive ?

7099

inside

Explorer

7099

ICMP covert channel detection

7099

inside

Collaborator

7098

Bypass Windows & Office update from TP (AV & Sandboxing)

7098

inside

Advisor

7097

Autonomous Threat Prevention; How to disable Threat Emulation and Threat Extraction for NGTP Gateway

7097

Solved

inside

Advisor

7000

Threat policy on internal traffic

7000

inside

Employee

6999

Use of Private ThreatCloud behind Load Balancer

6999

inside

Explorer

6999

IOC import

6999

inside

Collaborator

6999

DNS flag day and DNS inspection

6999

inside

Contributor

6900

Exclude Vulnerability Scanners from IPS Inspection

6900

Solved

inside

Contributor

6900

mail alert from checkpoint

6900

inside

Explorer

6899

IPS Signatures best practices

6899

inside

Collaborator

6899

IPS signature does not match with attack type

6899

inside

Advisor

6899

IPS Signature for CVE-2017-3737

6899

inside

Not applicable

6799

Next Gen Threat Prevention, WAF, OWASP Top 10 Comparison

6799

inside

Participant

6799

About IPS Signature

6799

inside

Contributor

6699

Will CheckPoint Firewall AV Blade Block Eicar?

6699

inside

Participant

6699

PSL Drop ADVP on DHCP Packets

6699

inside

Contributor

6699

How packet flow works inside the IPS blade..?

6699

inside

Participant

6599

Verify that DNS tunneling is being prevented in R80.10

6599

inside

Contributor

6599

Antivirus update

6599

Solved

inside

Contributor

6599

Block the FTP PUT Protocol

6599

inside

Contributor

6500

Where does the IPS packet capture and logs store in management server on distributed environment

6500

inside

Contributor

6500

Where can I download the ips offline signature

6500

inside

Contributor

6499

MTA - mail delayed

6499

inside

Contributor

6400

block files based on hash

6400

Solved

inside

Contributor

6399

Whitelist site blocked by URL Reputation (Anti-Bot)

6399

Solved

inside

Participant

6399

Inspection Settings Exception "install on" gateway missing

6399

Solved

inside

Explorer

6300

Blocking C&C communication

6300

Solved

inside

Advisor

6300

IOC feed using CSV or txt

6300

inside

Explorer

6299

HTTPS Inspection with Mircosoft CA R80.10

6299

inside

Employee Alumnus

6299

IPS utilization report - Smart View

6299

inside

Contributor

6299

Custom intelligence feed and TOR with our internal CA

6299

inside

Authority

6199

SPF with MTA

6199

inside

Admin

6199

White Paper - Distributed IPS Integration with Extreme Networks Network Access Control

6199

Solved

inside

Contributor

6199

Inbound SSL Inspection Certificate Issues

6199

inside

Participant

6199

Microsoft Attack Simulation URLs - Anti-Virus Blade Exceptions - DNS query Prevents

6199

inside

Legend

6198

Downloading Original Document from Threat Extraction

6198

inside

Explorer

6099

Increasing Performance and Use Cases for separate IPS Profiles

6099

inside

Collaborator

6099

How to Tune the IPS

6099

inside

Contributor

6097

Problem cloning/adding IPS profile

6097

Solved

inside

Participant

6000

Best Practices Against Ultrasurf

6000

inside

Collaborator

5999

Protocol violation detected with protocol:, matched protocol sig_id:(1), violation sig_id:(9). (500)

5999

Solved

inside

Contributor

5999

Ips report of protections

5999

Solved

inside

Contributor

5999

URL shorteners tagged as spam

5999

Solved

inside

Advisor

5999

Logging and monitoring: Packet Capture retention period

5999

inside

Explorer

5900

Having issues with firewall dropping mail as spam

5900

inside

Explorer

5900

Application whitelist

5900

Solved

inside

Contributor

5899

5600 standalone performance

5899

inside

Contributor

5899

Google Maps and https inspection

5899

inside

Explorer

5899

Contract entitlement check failed - Antibot and Antivirus

5899

inside

Participant

5799

To enable or not to enable an IPS signature...

5799

inside

Employee

5799

IPS Protections in Detect (Staging) State

5799

inside

Explorer

5799

Why Checkpoint is dropping http 302 redirect?

5799

inside

Collaborator

5799

IPS license

5799

inside

Participant

5799

Anti Virus Update Status Gaia

5799

inside

Explorer

5700

Firewall IPS and Check Point protocol

5700

inside

Collaborator

5700

Top Level Domain (TLD) Blocks

5700

inside

Contributor

5699

FW Samp or penalty box

5699

inside

Explorer

5699

"Release Date" and "Update Date" column of the IPS Signature Export formatting incorrectly

5699

Solved

inside

Collaborator

5699

Malware DNS trap with firewall's management IP

5699

inside

Contributor

5699

Anti-Virus not blocking malicious .zip, .doc files.

5699

inside

Collaborator

5698

Some DNS request not block by AV blade

5698

inside

Participant

5600

IPS questions

5600

Solved

inside

Employee Alumnus

5599

The best solution for blocking malicious IP

5599

Solved

inside

Contributor

5599

Configuring checkpoint as mail relay using MTA

5599

inside

Explorer

5599

Https inspection for ips incoming traffic with thrid party CA

5599

Solved

inside

Contributor

5598

Error: Failed to fetch Threat Prevention policy

5598

Solved

inside

Participant

5499

SHA-1

5499

inside

Collaborator

5499

Threat Prevention Policy

5499

Solved

inside

Contributor

5499

Question RAD DNS Traffic

5499

inside

Collaborator

5496

IPS bypass under load - any way to exclude certain cores ?

5496

Solved

inside

Contributor

5400

3rd party Phishing testing url being identified as malicious, unable to whitlist fully.

5400

inside

Champion

5399

HTTP parsing error occurred, bypass request.

5399

Solved

inside

Advisor

5399

https inspection outbound CA certificate step#1

5399

inside

Advisor

5299

Anti-spam and email security blade always bypassing all emails

5299

inside

Authority

5299

can't install ThreatPrevention policy after hardware replacement

5299

inside

Participant

5199

Cannot open packet capture files in ips log

5199

inside

Advisor

5199

Discussion SMB scan problem

5199

inside

Explorer

5199

Chrome browser causes ssl enforcment violations

5199

inside

Participant

5199

IPS Protection signatures with same name having diff. CVE number

5199

Solved

inside

Explorer

5199

CVE-2023-23397

5199

inside

Explorer

5100

Allow File Download from certain URLs

5100

Solved

inside

Authority

5100

Websites using TLS 1.3 are not categorized correctly using "Categorize HTTPS Sites" feature

5100

inside

Champion

5099

IPS Update check per domain R77.30

5099

Solved

inside

Advisor

5099

IPS not enabled but still receiving notice of expired blade

5099

Solved

inside

Contributor

5099

Zero Phishing - will it work without FQDN configured on SecGW?

5099

inside

Employee

5000

CloudGuard SaaS Identity Protection - Demo Snippet

5000

inside

Contributor

5000

Threat Prevention Policy Layers

5000

inside

Explorer

4999

Private SMTP Commands

4999

inside

Collaborator

4999

Profiles - Deleting Off - Objects being used

4999

Solved

inside

Advisor

747

API AV

747

inside

Explorer

1147

Global Policy Exceptions - Grayed out

1147

Solved

inside

Advisor

1869

IPS defense: Cross-site scripting over HTTP

1869

inside

Advisor

958

Clean up Private Threat Cloud and Download Agent

958

inside

Collaborator

1936

IPS Automatic Update Not Working

1936

inside

Advisor

971

Ivanti Connect Secure VPN IOCs

971

Solved

inside

Contributor

12195

How to whitelist a URL for all the threat prevention blades

12195

inside

Participant

3187

Anti-Bot and Anti-Virus Update Error

3187

inside

Contributor

667

Content Awareness does not scan HTML files by default

667

inside

Collaborator

1357

Zero Phishing - in-browser phishing prevention

1357

Solved

inside

Advisor

15675

MTA and Non Delivery Report

15675

Solved

inside

Advisor

1525

Reason for MTA bounced email

1525

inside

Explorer

1355

GEOIP Block / Allow With Updateable Objects - How to allow and continue to main rule base like befor

1355

inside

Contributor

4114

IPS - Failed to update IPS database

4114

inside

Advisor

979

Exception Traffic from Blade Antivirus

979

inside

Explorer

832

Interoperability between sandblast and office

832

inside

Contributor

864

New R82 and JSON format

864

inside

Explorer

1482

Loguid and session id issue (suppressed log time problem on splunk)

1482

inside

Advisor

1011

Replacing PTC hardware

1011

Solved

inside

Advisor

1587

Command Injection Over HTTP Payload

1587

Solved

inside

Participant

2027

URL Filtering vs. URL Reputation

2027

inside

Advisor

658

Crowdstrike IOC

658

inside

Explorer

714

Threat Prevention API query not detecting uploaded pdf file

714

Solved

inside

Explorer

1321

Malware dns trap exception for locally-hosted public nameservers?

1321

inside

Participant

11191

Content Awareness R80.10 - Blocked request

11191

inside

Explorer

722

Monitor Custom Intelligence Feeds

722

Solved

inside

Contributor

6956

mail alert from checkpoint

6956

inside

Explorer

864

Threat Prevention API - tecli emulations

864

inside

Explorer

1663

Threat Prevention API - not reaching 100MB

1663

inside

Explorer

1741

Block incoming malicious IP for VSX

1741

Solved

inside

Participant

1376

Zero Phishing Exception breaks policy install with Autonomous Threat prevention

1376

inside

Explorer

2226

Multiple IP connection to local server

2226

Solved

inside

Contributor

2565

Access role object on threat prevention policy rule

2565

Solved

inside

Advisor

4023

Autonomous Threat Prevention service is down

4023

inside

Contributor

17313

Slow performance when Antivrus enabled.

17313

inside

Contributor

1598

Antivirus & Antibot Blades Causing slow connection

1598

inside

Explorer

1247

URL exclusion to chakpoint antibot module

1247

inside

Collaborator

7705

Anti-Bot IP Reputation

7705

inside

Contributor

1359

Tons of empty (informal) IPS logs

1359

inside

Explorer

2479

Blocking traffic based on HTTP Request Header

2479

Solved

inside

Explorer

1521

Zero Phishing blade in R81.20

1521

inside

Explorer

1312

Reasons for classification of confidence level of Anti-Virus blade and IPS blade under our firewall

1312

inside

Participant

3376

HTTPS Inspection untrusted certificate

3376

inside

Contributor

989

Threat Prevention Utilization

989

Solved

inside

Collaborator

3358

Check Point Threat Extraction Secured This Document

3358

inside

Contributor

17806

IPS update Failed :

17806

inside

Contributor

1411

Monitor Check Point CVE

1411

inside

Advisor

2821

TE2000XN and TE250XN limitations

2821

Solved

inside

Participant

1601

I would like to know about te equipment licensing.

1601

inside

Collaborator

8323

How to prevent TLS1.0 traffic passing through gateway using IPS

8323

Solved

inside

Advisor

5130

IPS not enabled but still receiving notice of expired blade

5130

Solved

inside

Explorer

1630

Connection was allowed because background classification mode was set

1630

Solved

inside

Leader

1204

Enabling Anti-Phishing on R81.20 VSX without Internet interface

1204

Solved

inside

Collaborator

1643

Different IPS profiles for different gateways

1643

inside

Participant

1693

"Packet capture is not supported on this platform" when attempting to install policy on SMB 1570

1693

inside

Participant

3215

MTA Antivirus

3215

inside

Explorer

746

Threat Map Data

746

Solved

inside

Collaborator

2531

IPS Protection vs Check Point Advisories Archive

2531

inside

Contributor

1287

Performace Impact Question

1287

inside

Participant

690

TE/TX User Check Message

690

inside

Contributor

18462

Inspection Settings

18462

inside

Employee Alumnus

624

How AI prevents Brand Spoofing Attacks -WEBINAR

624

inside

Explorer

1371

How to create a trigger for the IPS critical alert?

1371

inside

Advisor

1279

Structural failure on anti-bot?

1279

inside

Contributor

1531

IPS Protection for MOVEit Transfer SQL Injection (CVE-2023-34362)

1531

inside

Contributor

2541

Is there any tool or script to trigger IPS signature directly from Checkpoint gateway to test IPS

2541

Solved

inside

Participant

2413

Custom Intelligence Feed Entry/Size Limit

2413

inside

Contributor

10650

How to block Hashes of malware by IPS signature

10650

Solved

inside

Contributor

5624

Error: Failed to fetch Threat Prevention policy

5624

inside

Advisor

1459

Traffic blocked by AV and Anti-Bot blades

1459

Solved

inside

Employee

4505

'Water Torture' attack , DDoS against DNS

4505

inside

Participant

895

TA SandBlast MTA Blade - False Positive!?

895

inside

Contributor

778

Elastic integration R81.10 collection lamina IPS

778

inside

Participant

704

IPS Signature for AntiBOT

704

inside

Contributor

5726

Anti-Virus not blocking malicious .zip, .doc files.

5726

Solved

inside

Explorer

1348

CDR How to bypass a domain

1348

Solved

inside

Advisor

4393

is_whitelist_domain_enable ?

4393

inside

Collaborator

4708

IPS Contract Shows Expired in FWMGR After Renewal

4708

Solved

inside

Participant

2467

IOC Feeds does not work properly

2467

inside

Collaborator

7370

Bypass Windows & Office update from TP (AV & Sandboxing)

7370

inside

Explorer

1828

Autonomous Policy Statistics Disabled

1828

inside

Explorer

962

Malicious Zipped Archives allowed to be downloaded

962

Solved

inside

Explorer

1473

Autonomous Threat Prevention Service Isnt Working

1473

Solved

inside

Contributor

1674

Block password protected archive - MTA

1674

inside

Legend

16560

URLF / APCL Whitelisting

16560

Solved

inside

Participant

1528

IPS package update notifications

1528

inside

Advisor

1773

Doubt about Threat Prevention

1773

Solved

inside

Advisor

1949

TE support Windows 11 OS for Threat Emulation appliances - when?

1949

Solved

inside

Participant

4990

Importing External Custom Intelligence Feeds in SmartConsole - Custom feed settings

4990

inside

Participant

2485

Log just detected not prevented

2485

inside

Advisor

4163

IPS drooped traffic without without specifying a protection name

4163

inside

Employee

1282

Autonomous Threat Prevention Profiles, R81.10, Reporting

1282

inside

Advisor

1189

explain TP Log

1189

Solved

inside

Legend

1554

Threat prevention (IPS) query

1554

inside

Contributor

1647

How do I know if a file is dropped? 'Threat Emulation'

1647

Solved

inside

Contributor

6430

Whitelist site blocked by URL Reputation (Anti-Bot)

6430

Solved

inside

Mentor

16125

IPS issue (R80.20) - cannot remove IPS blade from GW object

16125

inside

Participant

3320

Performance Improvement When "Core Protections" Use A Separate Threat Prevention Profile

3320

inside

Legend

1419

IPS Performance Impact Ratings only apply to R80.30?

1419

Solved

inside

Collaborator

4232

Best Practice to block traffic originating from anonymizers(R81.10)

4232

inside

Contributor

2479

Threat Emulation Blade , "Failed to process file"

2479

inside

Explorer

3813

SNMP MIBS for IPS Blade

3813

inside

Advisor

3741

Anti-Bot Correlated Logs

3741

inside

Contributor

6938

Exclude Vulnerability Scanners from IPS Inspection

6938

inside

Collaborator

1725

IPS exclusions still show alert in logs

1725

inside

Advisor

16344

Anti-Virus log prompt: "background classification mode was set"

16344

inside

Advisor

1877

Gaia R81.20 Titan Zero-Phishing is breaking Apple iCloud Private Relay, how to whitelist and debug

1877

Solved

inside

Mentor

22348

IPS Analyzer Tool - are you running it?

22348

inside

Participant

3666

Threat Prevention logs

3666

Solved

inside

Explorer

5280

CVE-2023-23397

5280

inside

Contributor

15614

Geo Blocking

15614

inside

Participant

5174

Blocking old SSL/TLS Versions on GW

5174

inside

Contributor

4330

IPS update failed - Error: Update failed. Gateway can not access internet

4330

Solved

inside

Explorer

2125

CVE-2023-23397: Microsoft Outlook Elevation of Privilege Vulnerability

2125

inside

Participant

3106

Troubleshoot Geo policy after sk126172

3106

inside

Explorer

2058

Stop Logging DNS Reputation traffic

2058

Solved

inside

Participant

2575

IPS Offline Update feature disabled on SmartConsole

2575

Solved

inside

Contributor

1241

Regarding IPS Update

1241

inside

Advisor

912

Backup procedure PTC

912

inside

Participant

1551

Threat Emulation Mail exception for sender/recipient pair

1551

inside

Contributor

4457

Yara signatures usage

4457

inside

Participant

2226

Determining Which Anti-Bot, Anti-Virus, Threat Emulation Overrides Are Active

2226

Solved

inside

Explorer

1275

Running Profile Cleanup on Threat Prevention profiles cloned from Optimized

1275

inside

Advisor

1627

Threat Prevention as shared layer

1627

Solved

inside

Participant

6027

Best Practices Against Ultrasurf

6027

inside

Participant

4391

fw_spii_execute_inspections Reason: spii inspection matrix drop

4391

inside

Collaborator

5522

Threat Prevention Policy

5522

inside

Advisor

7206

Autonomous Threat Prevention; How to disable Threat Emulation and Threat Extraction for NGTP Gateway

7206

inside

Participant

2117

Concerning on blades policy

2117

inside

Collaborator

1387

IPS Blade

1387

inside

Participant

2257

No details in Threat Prevention Logs

2257

inside

Authority

5312

can't install ThreatPrevention policy after hardware replacement

5312

No messages.

Threat Prevention

Your place to discuss Check Point's Advanced Network Threat Prevention products, including Threat Emulation (Sandboxing, Threat Extraction (a.k.a. Content Disarm and Reconstruction (CDR), Intrusion Prevention System, Anti-Bot, Antivirus, and Anti-Spam solutions.

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

User

Count

Upcoming Events

Sort by:

In-Person

Thu 15 May 2025 @ 09:00 AM (IDT)

PA In-Person CloudGuard Workshop (CGNS, WAF, & API Security)

Virtual

Tue 20 May 2025 @ 10:00 AM (IDT)

Building a Scalable Cybersecurity Skill Development Program: 4 Strategies for Success - EMEA

Virtual

Tue 20 May 2025 @ 05:00 PM (CEST)

Building a Scalable Cybersecurity Skill Development Program: 4 Strategies for Success - AMER

Virtual

Tue 20 May 2025 @ 12:00 PM (EDT)

Configuring Domain-based Site to Site VPN with Azure Virtual WAN and CloudGuard Network Security

In-Person

Tue 20 May 2025 @ 11:30 AM (PDT)

Las Vegas: Check Point Hybrid Mesh

Wed 21 May 2025 @ 05:00 PM (CEST)

TechTalk: Detecting Threats Across the Open, Deep and Dark Web With Infinity ERM

Virtual

Tue 20 May 2025 @ 10:00 AM (IDT)

Building a Scalable Cybersecurity Skill Development Program: 4 Strategies for Success - EMEA

Virtual

Tue 20 May 2025 @ 05:00 PM (CEST)

Building a Scalable Cybersecurity Skill Development Program: 4 Strategies for Success - AMER

Virtual

Tue 20 May 2025 @ 12:00 PM (EDT)

Configuring Domain-based Site to Site VPN with Azure Virtual WAN and CloudGuard Network Security

Virtual

Wed 21 May 2025 @ 05:00 PM (CDT)

TechTalk: Detecting Threats Across the Open, Deep and Dark Web With Infinity ERM

Virtual

Thu 22 May 2025 @ 03:00 PM (CEST)

Speed, Scale, and SASE: Reimagining Network Security - EMEA

Virtual

Thu 22 May 2025 @ 02:00 PM (EDT)

Speed, Scale, and SASE: Reimagining Network Security - Americas

In-Person

Thu 15 May 2025 @ 09:00 AM (IDT)

PA In-Person CloudGuard Workshop (CGNS, WAF, & API Security)

In-Person

Tue 20 May 2025 @ 11:30 AM (PDT)

Las Vegas: Check Point Hybrid Mesh

In-Person

Wed 21 May 2025 @ 11:30 AM (MST)

Tempe, AZ: Check Point Hybrid Mesh

In-Person

Tue 03 Jun 2025 @ 09:00 AM (CEST)

CheckMates LIve France - Workshop Check Point Quantum

In-Person

Tue 03 Jun 2025 @ 06:00 PM (EDT)

Montreal: CPX Recap

In-Person

Tue 10 Jun 2025 @ 06:00 PM (EDT)

Quebec City: CPX Recap

CheckMates Events

Are you a member of CheckMates?