Sophos Firewall
TMA-SOPHOS-4.7
Ensure NDR Essentials is enabled and configured
Опис
NDR Essentials is a cloud-hosted NDR solution that integrates directly with Sophos firewall. It uses advanced machine learning to detect threats in real-time without impacting the firewall's performance. This provides an additional layer of security in addition to existing firewall protection. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).
Како се проверава
Метод провере: Ручни преглед
Navigate to Protect > Active threat response > NDR Essentials. Turn 'ON' NDR Essentials. Interfaces > Select an 'Interface' so that NDR Essentials can identify new IoCs from the traffic flowing through them. Select the 'Data center location' to which the traffic is sent for analysis. The default option is 'Let's Sophos Decide'. Select the traffic's 'Minimum threat score' at which the firewall detects and logs threats. (Full steps: CIS 4.7.)
Како се исправља
Метод исправке: Смерница или закрпа инфраструктуре
Navigate to Protect > Active threat response > NDR Essentials. Turn 'ON' NDR Essentials. Interfaces > Select an 'Interface' so that NDR Essentials can identify new IoCs from the traffic flowing through them. Select the 'Data center location' to which the traffic is sent for analysis. The default option is 'Let's Sophos Decide'. Select the traffic's 'Minimum threat score' at which the firewall detects and logs threats. The default setting is High risk (Score 9 and 10) - Recommended Under Actions, the option is set to Log threats, because NDR Essentials currently only detects and logs threats. Click on Apply
Својства
- Оперативни системи
- Било који
- Ознаке
- sophosthreat-prevention
- Референца
- CIS Sophos Firewall v22 Benchmark v1.0.0 - 4.7 Ensure NDR Essentials is enabled and configured