Security Profiles
Security Profiles are added to the end of Security policy rules.
After a packet has been allowed by the Security policy, Security
Profiles are used to scan packets for threats, vulnerabilities,
viruses, spyware, malicious URLs, data exfiltration, and
exploitation software. Traffic also can be scanned for suspicious
file uploads.
A Security Profile Group can be created that includes one or more
Security Profiles, which simplifies the task of adding Security
Profiles to a Security policy rule.
The following table describes the Security Profile types:
Threat Logs
Threats are recorded and logged in the Threat log. A Threat log
display entries when traffic matches one of the Security Profiles
attached to a Security policy rule on the firewall. Each entry
includes the following information: date and time; type of threat
(such as virus or spyware); threat description or URL (Name
column); source and destination zones, addresses, and ports;
application name; alarm action (such as allow or block); and
severity level. The Threat log is used as the source of information
that is displayed on the ACC tab (Application Control Center).