TMA-SOPHOS-4.6
Ensure Third-party Threat Feeds is enabled
Mô tả
Third party feed is a part of Active threat response feature on Sophos Firewall. It allows you to add threat intelligence from external threat feed sources to the firewall. The firewall automatically blocks traffic based on the IPv4 addresses, domains, and URLs listed in the feeds. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).
Cách kiểm tra
Phương pháp kiểm tra: Xem xét thủ công
Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.
Navigate to Protect > Active threat response > Third-party feeds > Add Select the Action either 'Block' or 'Monitor' Indicator type from 'IPv4 address' , 'Domain' or 'URL' Enter the 'External URL' where the threat feed file is hosted. Under ' Authorization' select the authentication type to authorize the threat feed update. Select 'Validate server certificate' if you want to validate the server certificate Select the polling interval to synchronize the threat feed. Click on 'Test Connection' to test the connection and then Save the configuration.
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
Navigate to Protect > Active threat response > Third-party feeds > Add Select the Action either 'Block' or 'Monitor' Indicator type from 'IPv4 address' , 'Domain' or 'URL' Enter the 'External URL' where the threat feed file is hosted. Under ' Authorization' select the authentication type to authorize the threat feed update. Select 'Validate server certificate' if you want to validate the server certificate Select the polling interval to synchronize the threat feed. Click on 'Test Connection' to test the connection and then Save the configuration.
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- sophosthreat-prevention
- Tham chiếu
- CIS Sophos Firewall v22 Benchmark v1.0.0 - 4.6 Ensure Third-party Threat Feeds is enabled