There are four classes of what are commonly considered IPS protections/signatures:
1) IPS ThreatCloud Protections (15,000+ and always increasing)
2) Core Activations (39)
3) Inspection Settings (146)
4) Geo Policy (deprecated and replaced by Geo Updatable Objects)
The Default_Protection profile is related to Inspection Settings. How you deal with each of these classes (profiles, creating exceptions, etc) is quite different and nicely covered in the upcoming 2-day Check Point Threat Prevention Specialist class, that should should be released to Check Point ATCs worldwide at the end of this month. Highly recommended!
Attend my 60-minute "Be your Own TAC: Part Deux" Presentation
Exclusively at CPX 2025 Las Vegas Tuesday Feb 25th @ 1:00pm