Sophos Firewall
TMA-SOPHOS-4.7
Ensure NDR Essentials is enabled and configured
Açıklama
NDR Essentials is a cloud-hosted NDR solution that integrates directly with Sophos firewall. It uses advanced machine learning to detect threats in real-time without impacting the firewall's performance. This provides an additional layer of security in addition to existing firewall protection. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).
Nasıl denetlenir
Denetim yöntemi: Manuel inceleme
Navigate to Protect > Active threat response > NDR Essentials. Turn 'ON' NDR Essentials. Interfaces > Select an 'Interface' so that NDR Essentials can identify new IoCs from the traffic flowing through them. Select the 'Data center location' to which the traffic is sent for analysis. The default option is 'Let's Sophos Decide'. Select the traffic's 'Minimum threat score' at which the firewall detects and logs threats. (Full steps: CIS 4.7.)
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
Navigate to Protect > Active threat response > NDR Essentials. Turn 'ON' NDR Essentials. Interfaces > Select an 'Interface' so that NDR Essentials can identify new IoCs from the traffic flowing through them. Select the 'Data center location' to which the traffic is sent for analysis. The default option is 'Let's Sophos Decide'. Select the traffic's 'Minimum threat score' at which the firewall detects and logs threats. The default setting is High risk (Score 9 and 10) - Recommended Under Actions, the option is set to Log threats, because NDR Essentials currently only detects and logs threats. Click on Apply
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- sophosthreat-prevention
- Referans
- CIS Sophos Firewall v22 Benchmark v1.0.0 - 4.7 Ensure NDR Essentials is enabled and configured