Advanced Threat Prevention Engine Settings
Quantum Spark 1500, 1600 and 1800 Appliance Series R80.20.40 Locally Managed Administration Guide | 210
n
Process specific file type families
- Click
Configure
for a list of file types and set prescribed
actions to take place when these files pass through the Anti-Virus engine. To edit an action for
a specified file type, right-click the row and click
Edit
.
The available actions are:
l
Scan
- The Anti-Virus engine scans files of this type.
l
Block
- The Anti-Virus engine does not allow files of this type to pass through it.
l
Pass
- The Anti-Virus engine does not inspect files of this type and lets them pass
through.
You cannot delete system defined file types. System defined file types are recognized by
built-in signatures that cannot be edited. Manually defined file types are recognized by
their extension and are supported through the web and mail protocols.
4. You can set
policy overrides
to override the general policy setting defined on the Threat Prevention
Blade Control page. For each of the below protection type options, you can set the applicable
override action: Ask, Prevent, Detect, Inactive, or According to policy (no override). See the
Threat
Prevention
>
Threat Prevention Blade Control
page for a description of the action types.
n
URLs with malware
- Protections related to URLs that are used for malware distribution and
malware infection servers.
n
Viruses
- Real-time protection from the latest malware and viruses by examining each file
against the Check Point ThreatCloud database.
To enable Detect-only mode:
Select the checkbox.
Anti-Bot
You can set
policy overrides
to override the general policy settings defined on the
Threat Prevention Blade
Control
page. For each of the below protection type options, you can set the applicable override action: Ask,
Prevent, Detect, Inactive, or According to policy (no override). See the
Threat Prevention
>
Threat
Prevention Blade Control
page for a description of the action types.
n
Malicious activity
- Protections related to unique communication patterns of botnet and malware
specified families.
n
Reputation domains
- Protections related to Command & Control (C&C) servers. Each host is
checked against the Check Point ThreatCloud reputation database.
n
Reputation IPs
- Protections related to Command & Control (C&C) servers. Each IP is checked
against the Check Point ThreatCloud reputation database.
n
Reputation URLs
- Protections related to Command & Control (C&C) servers. Each URL is checked
against the Check Point ThreatCloud reputation database.
n
Unusual activity
- Protections related to the behavioral patterns common to botnet and malware
activity.
To enable Detect-only mode:
Select the checkbox.
