{"id":90854,"date":"2020-08-07T01:42:11","date_gmt":"2020-08-06T23:42:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/3-check-point-sandblast-agent-management-platform-politika-threat-prevention"},"modified":"2020-08-07T01:42:11","modified_gmt":"2020-08-06T23:42:11","slug":"3-check-point-sandblast-agent-management-platform-politika-threat-prevention","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/3-check-point-sandblast-agent-management-platform-politika-threat-prevention","title":{"rendered":"3. Check Point SandBlast Agent Management Platform. Threat Prevention Policy.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"3.
\n
\nWelcome to the third article in the series about the new cloud management console for personal computer protection \u2014 Check Point SandBlast Agent Management Platform. As a reminder, in first article)<\/a><\/noindex> we got acquainted with the Infinity Portal and created the cloud management service for agents Endpoint Management Service. In second article<\/a><\/noindex> we explored the web console management interface and installed the agent with the default policy on a user machine. Today, we will examine the contents of the standard Threat Prevention security policy and test its effectiveness against popular attacks.
\n<\/a><\/noindex><\/p>\n

Standard Threat Prevention Policy: Description<\/h2>\n

\n\"3.<\/a><\/noindex><\/p>\n

The figure above presents the standard rule of the Threat Prevention policy, which by default applies to the entire organization (all installed agents) and includes three logical groups of protection components: Web & Files Protection, Behavioral Protection, and Analysis & Remediation. Let\u2019s take a closer look at each of the groups.<\/p>\n

Web & Files Protection<\/h3>\n

<\/p>\n

URL Filtering<\/b>
\n URL Filtering allows control over user access to web resources using five pre-installed categories of websites. Each of the five categories contains several more specific subcategories, allowing for setup such as blocking access to the Games subcategory while allowing access to the Instant Messaging subcategory, both of which fall under the Productivity Loss category. URLs related to specific subcategories are defined by the company Check Point. You can check the category of a specific URL or request a category override on a special resource URL Categorization<\/a><\/noindex>.
\nAs an action, you can set Prevent, Detect, or Off. Also, when selecting the Detect action, a setting is automatically added that allows users to bypass the URL Filtering alert and proceed to the desired resource. If the Prevent action is chosen, this setting can be removed, and the user will be unable to access the blocked site. Additionally, a convenient way to manage blocked resources is by setting up a Block List, where you can specify domains, IP addresses, or upload a .csv file with a list of domains to be blocked.<\/p>\n

\"3.<\/a><\/noindex><\/p>\n

The standard policy for URL Filtering is set to action Detect and one category \u2014 Security has been selected for event detection. This category includes various anonymizers, websites with a Critical\/High\/Medium risk level, phishing sites, spam, and much more. However, users will still be able to access the resource thanks to the setting 'Allow user to dismiss the URL Filtering alert and access the website.'<\/p>\n

Download (web) Protection<\/b>
\n Emulation & Extraction allows for the emulation of uploaded files in the Check Point cloud sandbox and the cleaning of documents 'on the fly,' removing potentially malicious content or converting the document to PDF. There are three operating modes:<\/p>\n