Sophos Firewall
TMA-SOPHOS-4.7
Ensure NDR Essentials is enabled and configured
설명
NDR Essentials is a cloud-hosted NDR solution that integrates directly with Sophos firewall. It uses advanced machine learning to detect threats in real-time without impacting the firewall's performance. This provides an additional layer of security in addition to existing firewall protection. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).
점검 방법
감사 방식: 수동 검토
Navigate to Protect > Active threat response > NDR Essentials. Turn 'ON' NDR Essentials. Interfaces > Select an 'Interface' so that NDR Essentials can identify new IoCs from the traffic flowing through them. Select the 'Data center location' to which the traffic is sent for analysis. The default option is 'Let's Sophos Decide'. Select the traffic's 'Minimum threat score' at which the firewall detects and logs threats. (Full steps: CIS 4.7.)
조치 방법
조치 방식: 가이드 또는 인프라 패치
Navigate to Protect > Active threat response > NDR Essentials. Turn 'ON' NDR Essentials. Interfaces > Select an 'Interface' so that NDR Essentials can identify new IoCs from the traffic flowing through them. Select the 'Data center location' to which the traffic is sent for analysis. The default option is 'Let's Sophos Decide'. Select the traffic's 'Minimum threat score' at which the firewall detects and logs threats. The default setting is High risk (Score 9 and 10) - Recommended Under Actions, the option is set to Log threats, because NDR Essentials currently only detects and logs threats. Click on Apply
속성
- 운영 체제
- 모두
- 태그
- sophosthreat-prevention
- 참고 자료
- CIS Sophos Firewall v22 Benchmark v1.0.0 - 4.7 Ensure NDR Essentials is enabled and configured