Sophos Firewall
TMA-SOPHOS-4.7
Ensure NDR Essentials is enabled and configured
Deskripsi
NDR Essentials is a cloud-hosted NDR solution that integrates directly with Sophos firewall. It uses advanced machine learning to detect threats in real-time without impacting the firewall's performance. This provides an additional layer of security in addition to existing firewall protection. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).
Cara pemeriksaan
Metode audit: Tinjauan manual
Navigate to Protect > Active threat response > NDR Essentials. Turn 'ON' NDR Essentials. Interfaces > Select an 'Interface' so that NDR Essentials can identify new IoCs from the traffic flowing through them. Select the 'Data center location' to which the traffic is sent for analysis. The default option is 'Let's Sophos Decide'. Select the traffic's 'Minimum threat score' at which the firewall detects and logs threats. (Full steps: CIS 4.7.)
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
Navigate to Protect > Active threat response > NDR Essentials. Turn 'ON' NDR Essentials. Interfaces > Select an 'Interface' so that NDR Essentials can identify new IoCs from the traffic flowing through them. Select the 'Data center location' to which the traffic is sent for analysis. The default option is 'Let's Sophos Decide'. Select the traffic's 'Minimum threat score' at which the firewall detects and logs threats. The default setting is High risk (Score 9 and 10) - Recommended Under Actions, the option is set to Log threats, because NDR Essentials currently only detects and logs threats. Click on Apply
Properti
- Sistem operasi
- Apa saja
- Tag
- sophosthreat-prevention
- Referensi
- CIS Sophos Firewall v22 Benchmark v1.0.0 - 4.7 Ensure NDR Essentials is enabled and configured