Sophos XG Firewall | Protect | 518
Figure 482: SlowHTTP Protection Settings
3. Click Apply.
Advanced Threat
This chapter describes how to configure the advanced threat features of Sophos XG Firewall.
Advanced threat features are:
• Advanced Threat Protection
• Security Heartbeat
Those features require a valid Network Protection subscription.
Advanced Threat Protection
This page allows the administrator to configure the Advanced Threat Protection feature.
ATP can help rapidly detect infected or compromised clients inside the network and raise an alert or drop the respective traffic.
The Advanced Threat Protection analyzes network traffic, e.g., DNS requests, HTTP requests, or IP packets in general, coming from and going to all networks. It also incorporates Intrusion Prevention and Antivirus data if the respective features are activated.
Note: Advanced Threat Protection module is a subscription module that needs to be subscribed before use.
General Settings
Enable Advanced Threat Protection
By default Advanced Threat Protection is disabled. To enable Advanced Threat Protection, click on the slider. This will make several setting fields editable.
Logging (available only if Enable Advanced Threat Protection is enabled)
Logging is enabled. You can change the log setting by clicking Change log settings or by navigating to the Configure > System Services > Log Settings page and clicking Add Syslog
Server.
Policy
Select the security policy that the Advanced Threat Protection system should use if a threat has been detected.
Available Options:
Sophos XG Firewall | Protect | 519
• Log and Drop - The data packet will be dropped and logged.
• Log Only - The data packet will be logged.
Network/Host Exceptions
Add or select the source networks or hosts that should be exempt from being scanned for threats by Advanced Threat Protection. How to add an IP host is explained on the System > Hosts and
Services > IP Host page.
Threat Exceptions
Add destination IP addresses or domain names that you want to skip from being scanned for threats by Advanced Threat Protection.
Caution: Be careful with specifying exceptions. By excluding sources or destinations you may expose your network to severe risks.
Figure 483: Advance Threat Protection
Security Heartbeat
The Security Heartbeat tab allows you to configure the Security Heartbeat feature to share health information.
Security Heartbeat connects cryptographically secured endpoints and Sophos XG Firewall via Sophos Central.
This allows to exchange information between endpoint devices and Sophos XG Firewall. This information gives a comprehensive overview of the network security. The administrator is able to define policies for network access based on the health status of the endpoint. The Security Heartbeat widget on the Control Center page provides the health status of all endpoint devices.
Note: If traffic will be routed through a VPN connection before the heartbeat connection has been established, the heartbeat traffic will also be routed through the VPN tunnel and thus, the firewall cannot see this heartbeat traffic and marks the endpoint as missing. When the endpoint is in missing state, all traffic through the firewall from this endpoint will be blocked.
Note: A missing heartbeat will not be detected by Sophos XG Firewall if the endpoint is located behind an intermediate router. This does not lead to false results and the endpoint will still share the health status.
Security Heartbeat is not supported if the router is a NAT gateway, i.e. the endpoints do not share the health status with Sophos XG Firewall.
Endpoint devices and users need to authenticate via Sophos Central to connect to Sophos XG Firewall. The authentication works via a client which is available on Sophos Central and must be installed on the endpoint device.
Once the installation is completed, the endpoint uses the Sophos Endpoint Security and Control which is an
Sophos XG Firewall | Protect | 520 integrated suite of security software, for example, antivirus, behavior monitoring and live protection. Sophos
Endpoint Security and Control ensures that the endpoint device belongs to the system and has the permission to access the network.
Note: For more information and documentation about Sophos Endpoint Security and Control visit the
Sophos Website
.
In regular intervals, the endpoint sends a heartbeat signal to Sophos XG Firewall to show that it is alive. Furthermore, the endpoint also informs the Sophos XG Firewall about potential threats. If Sophos Endpoint Security and Control detects any threats, the endpoint sends this information to Sophos XG Firewall which declares the endpoints health status. Depending on the user policy which defines the permission of the different health status, the endpoint maynot able to connect to networks, zones or services.
Note: You can enable Security Heartbeat and set the Minimum Heartbeat Permitted in the User /
Network Rule which is managed on the Firewall > Add User / Network Rule page in the Security
Heartbeat section.
Note: Please find a description of the enpoints health status colors on the Health Status page.
To use security heartbeat you need to register with your Sophos Central account. If you do not have an account you can create a new one. For more information about Sophos Central, see:
https://www.sophos.com/en-us/lp/sophoscentral.aspx
.
Note: Sophos XG Firewall does not support Security Heartbeat with bonded interfaces on MAC endpoints.
Related concepts
Control Center
on page 11
User / Network Rule
on page 320
User/Network Rule is used to define access rights and protection to the network objects/hosts. In a nutshell, if you want to control traffic by source, service, destination, zone, then use a Network Rule. Additionally, the administrator has the option to attach user identity to a rule in order to customize access of assorted hosts/servers. Such an identity based rule is considered a User Rule.
Health Status
This page gives an overview of the health status of endpoints.
The health status can be red, yellow or green. If you are viewing multiple devices, the color together with the label indicates the status of the device with the worst health.
Red labeled "At risk"
You should take action. One or more of the following issues have occurred:
• Active malware has been detected or there might be active malware.
• Running malware has been detected.
• Malicious network traffic has been detected. This traffic might be headed to a command-and-control server involved in a botnet or other malware attack.
• Communications sent to a known bad host have been detected. This is based on the IP address or DNS resolution.
• Malware has not been cleaned up.
• Sophos security software is not working correctly. The device or devices might not be protected.
Red labeled "Missing"
You might take an action. One or more of the following issues occured:
• The endpoint is not sending heartbeat messages but is still using the network
• The endpoint might be compromised or broken.
Yellow labeled "Warning"
If you are very sensitive to security issues, you should take action. One of the following issues occurred:
• Inactive malware has been detected.
Sophos XG Firewall | Protect | 521
• A Potentially Unwanted Application has been detected.
Green
You do not need to do anything.
• Sophos security software is working correctly.
• No active malware has been detected.
• No inactive malware has been detected.
• No Potentially Unwanted Application has been detected.
Security Heartbeat Global Configuration
This page describes how to login with your Sophos Central account and enable Security Heartbeat.
1. Go to Protect > Advanced Threat > Security Heartbeat.
2. Specify the Sophos Central login details.
Email Address
Enter the email address of your Sophos Central account.
Password
Enter the password of your Sophos Central account.
Note: You can also create a Sophos Central account by clicking Create Cloud Account.
3. Click Register.
You are registered with your Sophos Central ID to the Sophos XG Firewall. Security Heartbeat is enabled.
4. Add zones to the Missing Heartbeat Zones field.
Missing heartbeats will be detected only in these zones.
Note: If a zone is blocked by a policy but but no zone is added here, in the Control Center "Missing" is displayed on the Security Heartbeat flipside.
5. Click Apply.
If you disable Security Heartbeat you are still registered with your Sophos Central account. This is a comfort function of Sophos XG Firewall and has no network security value.
To clear your registration from Sophos XG Firewall, click Clear Registration.
Sandstorm Activity
Activity records provide basic information such as the date and time on which files were sent to Sandstorm. They also indicate analysis and release status. Use the links provided to view report details and release files.
To filter the list, click the Filter button ( ) and specify criteria. For example, you can filter on a date range or file type.
To view details of a Sandstorm analysis, click Show report. Reports contain the following:
• Download details, for example, the source and download time
• File details, for example, the file name and type
• Result of the Sandstorm analysis
• Description of the potential threats contained by the file
• A list of all users who have downloaded the file
To release a file, click Release Now. When you release a file, users can download it immediately. Only files that are currently being analyzed or that have been returned with error status are eligible for release.
Sandstorm continues to analyze the file even if you release it.
CAUTION: Releasing an item before the analysis is complete may result in the downloading of malicious content.
Sophos XG Firewall | Appendix A - Logs | 522
Date
Date and time on which the file was sent to Sandstorm.
Recipient
IP address and user name associated with the download.
Source
Domain or IP address from which the user downloaded the file and the download type (web or email).
File Type
Type of file downloaded.
Status
Status of the analysis.
Manage
View release status and release files.
Sandstorm Settings
Use these settings to specify cloud location and files to exclude from Sandstorm analysis.
Cloud Location
Files to be analyzed by Sandstorm are transmitted using a secure SSL connection to a data center in the cloud. Data centers are located in the United States and Europe. By default, Sandstorm selects the closer data center according to the location of the device. You can override the default behavior by selecting a data center.
Note: Changing data centers may affect any analysis that is currently in progress.
Exclude File Types
A file type is a classification that is determined by file extension and MIME header. Click Add New
Item and select file types that you do not want to send to Sandstorm for analysis. Exclusions apply to web and email traffic.
Note: Any archive that includes a file of the selected type will also be excluded, regardless of what other types of files that archive may contain.
Note: Although you can add an exclusion for any type of file, many file types that are considered safe (for example, images) will never be sent to Sandstorm. Only risky file types that Sandstorm can detonate and analyze will be sent.
Related concepts
File Types
on page 415
A file type is a classification that is determined by file extension and MIME header. You can include file types in web policies to control access to files that match the specified criteria. The default file types contain some common criteria and you can create additional types.
Appendix A - Logs
Device provides extensive logging capabilities for traffic, system, and network protection functions. Detailed log information and reports provide historical as well as current analysis of network activity to help identify security issues and reduce network misuse and abuse.
Device provides following logs:
• System Logs
• Web Filter Logs
