Threat Prevention and Logging
Core concepts
Threat Prevention unifies IPS, Anti-Virus, Anti-Bot, Threat Emulation, and Threat Extraction under a single policy with profiles. Understand prevent vs detect modes, and how exceptions and indicators work. Know the ThreatCloud relationship for reputation and updates.
Logging
Every rule can Track with Log. Understand log fields (source, destination, service, action, rule, blade), log servers, and how to search logs. Know the difference between traffic logs, security logs, and audit logs. Understand log indexing and retention.
Traps in questions
- Assuming IPS is on by default - it must be enabled and a profile applied.
- Confusing detect (logs only) with prevent (blocks).
- Forgetting that a rule with Track=None produces no log, making troubleshooting blind.
- Mixing audit logs (admin actions) with security logs (traffic).
Worked example
An attack is blocked but you cannot find the log: check the rule's Track setting. If Track is None, no security log is generated; enable Log on the relevant rule or profile to capture it.