To access this page, select Configure>Threat Prevention > Policy.
You can create threat prevention policies from the policy page.
Note: If you are creating policies for the first time, you are given the option of setting up Policy Enforcer with Sky ATP or configuring Sky ATP alone. Clicking either button takes you to quick setup for your selection. See Comparing the SDSN and non-SDSN Configuration Steps for a configuration comparison.
To create a threat prevention policy:
The Create Threat Prevention Policy page appears.
Table 324: Fields on the Threat Prevention Policy Page
Field | Description |
|---|---|
Name | Enter a unique string that must begin with an alphanumeric character and can include underscores; no spaces allowed; 63-character maximum. |
Description | Enter a description; maximum length is 1024 characters. You should make this description as useful as possible for all administrators. |
Log Setting (Policy setting for all profiles) | Select the log setting for the policy. You can log all traffic, log only blocked traffic, or log no traffic. |
Table 225 shows the management of command and control server threat in a policy.
Table 325: C&C Server Profile Management
Field | Description |
|---|---|
Command and Control Server | Select and choose settings for command and control servers. A C&C is a centralized computer that issues commands to botnets (compromised networks of computers) and receives reports back from them. Botnets can be used to gather sensitive information, such as account numbers or credit card information, or to participate in a distributed denial-of-service (DDoS) attack. |
Include C& C profile in policy | Select the check box to include management for this threat type in the policy. |
Threat Score | Use the slider to change the action to be taken based on the threat score. Threat scores are assigned using several criteria. Refer to the monitoring pages in the UI to investigate, located under Monitor > Threat Management. |
Actions | If the threat score is high enough to cause a connection to be blocked, you have following configurable options:
|
Table 226 shows the management of infected host threat in a policy.
Table 326: Infected Host Profile Management
Field | Description |
|---|---|
Infected Host | Infected hosts are systems for which there is a high confidence that attackers have gained unauthorized access. Infected hosts data feeds are listed with the IP address or IP subnet of the host, along with a threat score. |
Include infected host profile in policy | Select the check box to include management for this threat type in the policy. Note: If you want to enforce an infected host policy within the network, you must include a switch in the site. |
Actions | You have following options:
|
Table 227 shows the management of malware threat in a policy.
Table 327: Malware Threat Profile Management
Field | Description |
|---|---|
Malware (HTTP file download, SMTP File attachment, and IMAP attachments) | Malware is files that are downloaded by hosts or received as email attachments and found to be suspicious based on known signatures, URLs. or other heuristics. |
Include malware profile in policy | Select the check box to include management for this threat type in the policy. |
HTTP file download | Turn this feature on to scan files downloaded over HTTP and then select a file scanning device profile. The device profile is configured using Sky ATP. |
Scan HTTPS | Turn this feature to scan encrypted files downloaded over HTTPS. |
Device Profile | Select a Sky ATP device profile. This is configured through Sky ATP. Sky ATP profiles let you define which files to send to the cloud for inspection. You can group types of files to be scanned together under a common name and create multiple profiles based on the content you want scanned.Device Profiles Overview. |
Actions | If the threat score is high enough to cause a connection to be blocked, you have following configurable options:
|
SMTP File Attachments | Turn this feature on to inspect files received as email attachments (over SMTP only). |
Scan SMTPS | Enable this option to configure reverse proxy for SMTP. The reverse proxy does not prohibit server certificates. It forwards the actual server certificate or chain as is to the client without modifying it. |
Device Profile | If you do not click the Change button to select a device profile for SMTP scanning, the device profile selected for HTTP will be used by default. Select Change to use a different device profile for SMTP. Device profiles are configured through Sky ATP and define which files to send to the cloud for inspection. |
Threat Score | Use the slider to change the action to be taken based on the threat score. Threat scores are assigned using several criteria. This threat score applies to all malware, HTTP and SMTP. (Note: There is no monitoring setting for malware.) |
Actions | Actions for SMTP File Attachments include: Quarantine, Deliver malicious messages with warning headers added, and Permit. This actions are set in Sky ATP. Refer to the Sky ATP documentation for information. |
IMAP Attachments | Turn this feature on to select a a file scanning device profile and threat score ranges to apply to IMAP e-mails. |
Scan IMAPS | Enable this option to configure reverse proxy for IMAP e-mails. |
Device Profile | If you do not click the Change button to select a device profile for IMAP scanning, the device profile selected for HTTP will be used by default. Select Change to use a different device profile for IMAP. Device profiles are configured through Sky ATP and define which files to send to the cloud for inspection. |
Actions | Actions for IMAP Attachments include: Block, Deliver malicious messages with warning headers added, and Permit. This actions are set in Sky ATP. Refer to the Sky ATP documentation for information. |
Threat Score | Use the slider to change the action to be taken based on the threat score. Threat scores are assigned using several criteria. This threat score applies to all malware, HTTP, SMTP, and IMAP. (Note: There is no monitoring setting for malware.) |
Table 228 shows the management of DDoS threat in a policy
Table 328: DDoS Threat Profile Management
Field | Description |
|---|---|
Include DDoS Profile in Policy | Enable this option to include the management of Distributed denial-of-service (DDoS) protection that enables the MX router to quickly identify an attack and prevent a flood of malicious control packets from exhausting system resources. When you create a threat policy for the DDoS profile, it is not pushed to the device because the policy is not yet assigned to any device. Assign the policy to the policy enforcement group. Because the policy is created for the MX router, rule analysis is not initiated when a policy is assigned to the policy enforcement group (PEG). |
Actions | Select the following actions from the list for the DDoS profile:
|
Scrubbing Site | Specify a routing instance to which packets are forwarded in the as-number:community-value format, where each value is a decimal number. For example, 65001:100. |
Once you have a threat prevention policy, you assign one or more groups to it: