TMA-SOPHOS-4.1
Ensure 'Sophos X-Ops threat feeds (Advanced threat protection)' is set to ‘Enabled' and Policy is set to ‘Log and drop'
Açıklama
Sophos X-Ops threat feeds is a SophosLabs managed global threat database that is regularly updates and pushed to the firewall. The firewall blocks all requests and traffic matching this database of malicious IP addresses, domains and URLs. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).
Nasıl denetlenir
Denetim yöntemi: Manuel inceleme
Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.
Navigate to 'Protect > Advanced threat response > Sophos X-Ops threat feeds (Advanced threat protection) > Sophos X-Ops threat feeds'. Verify that 'Sophos X-Ops threat feeds' is 'Enabled' Verify that action is set to 'Log and drop'. Verify that wide range of network/host IP addresses are not added to 'Host and network Exceptions'. Verify that wide range of domains, URLs or IP addresses are not added to 'Threat Exceptions' that may expose network to the security risks.
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
Navigate to 'Advanced threat response > Sophos X-Ops threat feeds (Advanced threat protection) > Sophos X-Ops threat feeds'. Enable Sophos X-Ops threat feeds Set the action to 'Log and drop'. Remove unnecessary exemption from network and threat exceptions.
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- sophoslogging
- Referans
- CIS Sophos Firewall v22 Benchmark v1.0.0 - 4.1 Ensure 'Sophos X-Ops threat feeds (Advanced threat protection)' is set to ‘Enabled' and Policy is set to ‘Log and drop'