Which Types of Traffic Can Be Automatically Blocked by Threat Intelligence Interception Mode?
After threat intelligence interception mode is enabled, outbound threat intelligence alarms are automatically intercepted by the NAT Firewall, while the Internet Firewall and inbound direction remain in observation mode.
Which Types of Traffic Can Be Automatically Blocked by Virtual Patch Interception Mode?
After virtual patching interception mode is enabled, the Internet Firewall automatically identifies vulnerability exploits and attacks in all Internet boundary traffic, and automatically blocks connections that generate alarms.
What Is the Difference Between CFW IPS Virtual Patches and CWPP Patches?
Patches for hosts are generally released by official vendors, and the release cycle is long. It usually takes weeks or even months to fix vulnerabilities, and some patches require restarting the CVM instance.
The IPS virtual patch in CFW is a defense rule that is updated in real time in the CFW IPS system based on vulnerability exploit characteristics. It can be updated on an hourly basis without requiring any modifications to your business or restarting business systems.
The IPS virtual patch in CFW, combined with host security products such as CWPP, provides comprehensive defense across both the network and host layers, making it the optimal combination for protecting host security.
Do I Still Need to Fix Patches on Hosts If Virtual Patches Are Used?
It still needs to be fixed. Virtual patches can provide you with frontline protection, but the root cause of the vulnerability must be thoroughly resolved to achieve the most secure protection.
How Are the Threat Levels of Intrusion Prevention Response Rules Defined?
The risk levels of basic defense and virtual patches are defined based on the potential harm that the attack may cause.
The risk level of threat intelligence is defined based on the severity of attacks that the IP address or domain has caused in Tencent Cloud historical big data.
How Does the CFW Threat Intelligence Package Update Review Mechanism Work?
The high-precision threat intelligence package has a complete false positive elimination process.
Can Virtual Patches in Intrusion Defense Identify Traffic That Exploits Shiro Vulnerabilities?
It can be detected, but not all scenarios can be covered because some traffic is encrypted.
Which Vulnerabilities Does CFW Protect Against?
How Does CFW Detect Web Attacks?
External hackers carry attack signatures during scanning and sniffing, such as WebLogic vulnerabilities. When the firewall detects these attack signatures, it determines the activity as an attempted attack.
Which Protocol Types Are Supported for Protection Against Brute-Force Authentication Attacks?
It supports MySQL, Oracle, SSH, Redis, MongoDB, IMAP, POP3, FTP, SMTP, SQLServer, and RDP protocols.
How to Handle Detected Mining Attacks?
If CWPP is not purchased, you do not necessarily need to reinstall the machine. Manual virus removal is sufficient. The occurrence of mining behavior indicates that the host is already infected.
If CWPP is already purchased, you can directly use it to remove threats.