View source for Threat Prevention

[[Category:Applications]]
<span style="display:none" class="helpSource threat_prevention">Threat_Prevention</span>
<span style="display:none" class="helpSource threat_prevention_status">Threat_Prevention#Status</span>
<span style="display:none" class="helpSource threat_prevention_threats">Threat_Prevention#Threats</span>
<span style="display:none" class="helpSource threat_prevention_rules">Threat_Prevention#Rules</span>
<span style="display:none" class="helpSource threat_prevention_lookup">Threat_Prevention#Threat_Lookup</span>

{| width='100%'
|-
| align="center" | [[Image:ThreatPrevention.png|128px]] &nbsp; &nbsp; '''Threat Prevention'''
| align="center" |
{|
|-
| Other Links:
|-
|[http://forums.untangle.com/threat-prevention/ Threat Prevention Forums]
|-
|[[Threat Prevention Reports]]
|-
|[[Threat Prevention FAQs]]
|}
|}
<br/>
----


== About Threat Prevention ==

Threat Prevention blocks potentially harmful traffic from entering or exiting the network. This app can prevent cyber attacks to your servers (e.g. web, VoIP, and email). It is also useful to prevent data loss in case users mistakenly try to connect to a phishing site or other type of malicious host.

Threat Prevention uses Threat Intelligence technology managed by Webroot BrightCloud®. It works by performing a query to the BrighCloud® service, requesting for the reputation score and historical data of each IP address or URL. Based on the rating of the IP address or URL, the session may be blocked. By default, the Threat Prevention app blocks sessions with a "High Risk" rating. IP addresses or URLs rated as High Risk may be associated with the following types of attacks:
* Spam Sources - IP addresses involved in tunneling spam messages through proxy, anomalous SMTP activities, and forum spam activities.
* Windows Exploits - IP addresses participating in the distribution of malware, shell code, rootkits, worms or viruses for Windows platforms.
* Web Attacks - IP addresses using cross site scripting, iFrame injection, SQL injection, cross domain injection, or domain password brute force attacks to target vulnerabilities on a web server. 
* Botnets - IP addresses acting as Botnet Command and Control (C&C) centers, and infected zombie machines controlled by the C&C servers. 
* Denial of Service  - The Denial of Service category includes DOS, DDOS, anomalous sync flood, and anomalous traffic detection.
* Scanners - IP addresses involved in unauthorized reconnaissance activities such as probing, host scanning, port scanning and brute force login attempts. 
* Phishing - IP addresses hosting phishing sites and sites related to other kinds of fraudulent activities. 
* TOR Proxy - IP addresses acting as exit nodes for the TOR Network. Exit nodes are the last point along the proxy chain and make a direct connection to the originator’s intended destination.
* Proxy - IP addresses providing proxy services, including both  VPN and open web proxy services.
* Mobile Threats - Denial of service, packet sniffing, address impersonation,  and session hijacking

== Settings ==

This section reviews the different settings and configuration options available for Threat Prevention.

=== Status ===

The Status screen shows the running state of Threat Prevention and relevant Metrics such as the number of blocked sessions and high risk threats.

{{AppScreenshot|threat-prevention|status}}

=== Threats ===

In the Threats tab you can specify the threshold for IP Addresses and URL Threats. The recommended and default Reputation Threshold is "High Risk". By moving the slider to the left you can choose to block more traffic however this may increase the number of false positives. As you move the slider, a description appears that provides more detail of what type of sessions apply to each threshold level.

{{AppScreenshot|threat-prevention|threats}}

=== Rules ===

The '''Rules''' tab allows you to specify rules to Block, Pass or Flag traffic that crosses the Untangle.

The [[Rules|Rules documentation]] describes how rules work and how they are configured. Threat Prevention uses rules to determine to block/pass the specific session, and if the sessions is flagged. Flagging a session marks it in the logs for reviewing in the event logs or reports, but has no direct effect on the network traffic.

In addition to all the common rule types, there are four that are unique to Threat Prevention, and these can be useful for making exceptions to the general *Reputation Threshold* setting.

'''Source address reputation threshold'''
The reputation value of a source IP address returned by the Webroot BrighCloud® service. This applies to incoming connections from the Internet to open services on your network.

'''Destination address reputation threshold'''
The reputation value of a destination IP address returned by the Webroot BrighCloud® service. This applies to outgoing connections to the Internet from hosts on your network.

'''Source address category'''
The reputation category of a source IP address returned by the Webroot BrighCloud® service. This applies to incoming connections from the Internet to open services on your network.

'''Destination address reputation threshold'''
The reputation category of a destination IP address returned by the Webroot BrighCloud® service. This applies to outgoing connections to the Internet from hosts on your network.

==== Rule Actions ====

* '''Pass''': Allows the traffic which matched the rule to flow.
* '''Block''': Blocks the traffic which matched the rule.

Additionally a session can be flagged. If '''Flag''' is checked the event is flagged for easier viewing in the event log. Flag is always enabled if the action is Block.

{{AppScreenshot|threat-prevention|rules}}

=== Threat Lookup ===
Threat Lookup enables you to get threat information on an IP Address or URL. This is useful to validate afterwards or confirm in advance the Reputation and other details of the IP Address or URL.
Enter an IP Address or URL in the input field and click '''Search''' to get information.

{{AppScreenshot|threat-prevention|threat-lookup}}

==== Threat Results ====
{| border="1" cellpadding="2" width="85%%" align="center" 
!Result
!Description
|-
| width="25%" | Address/URL
| width="60%" | The IP Address or URL you requested to search.
|-
| width="25%" | Country
| width="60%" | The country where the IP Address or URL originates.
|-
| width="25%" | Popularity
| width="60%" | The popularity of the IP Address or URL based on the volume of lookups.
|-
| width="25%" | Recent Threat Count
| width="60%" | The amount of recent occurrences that the IP Address or URL has been associated to a threat.
|-
| width="25%" | Age
| width="60%" | The amount of time since the IP Address or URL was first noticed.
|-
| width="25%" | Reputation
| width="60%" | The reputation of the IP Address or URL as determined by the Webroot BrightCloud reputation service.
|-
| width="25%" | Details
| width="60%" | A description of the Reputation value.
|-
|}

== Reports ==

{{:Threat Prevention Reports}}