Global Config

You can configure ATP Appliance to consider a host to be infected when a certain threat level is reached based on malware downloaded by that host. For example, you can add a host to the infected hosts feed when threshold of .75 is met. That host then appears in the list under Mitigation > Hosts.

To configure the threshold for marking hosts as infected:

From the Config tab, navigate to System Profiles > SRX settings. The Global Config setting is at the bottom of the page.
From the pulldown, select a threshold:

Table 1: Threat Score Values
Value

Severity

.25

Low

.50

Medium

.75

High

1.0

Critical

Note that ATP Appliance and SRX use different threat level thresholds. See the ATP Appliance and SRX Series Threat Level Comparison Chart for information.
Click the Submit button to save your setting.

Table 1: Threat Score Values
Value	Severity
.25	Low
.50	Medium
.75	High
1.0	Critical

Global Config

Related Documentation