Intrusion Detection & Prevention
Monitor server-to-server and internet traffic with signature-based inspection, generate alerts and optionally block the attack.
Threat protection to help protect your digital assets
Strengthen your network security posture
Compare network traffic with signatures that describe known attack patterns, and on a match raise an alert or block the traffic before it reaches its target.
Prevent malware from spreading
When enabled for your environment, east-west traffic between servers is inspected on the hypervisor hosts, where an attempt to spread through the internal network is detected.
Inspect traffic in real time
Internet ingress and egress traffic is inspected at the gateway with a separate protection profile defined for the internet edge.
Stay protected with current signatures
The signature database updates automatically; new signatures are checked every 20 minutes by default and two signature versions are kept.
Example scenarios
A company watching its internet-facing servers
Internet ingress and egress traffic is inspected at the gateway with its own protection profile. It starts in detect-only mode and moves to detect-and-prevent once the settings have settled.
An organisation catching attempts to spread inside its network
East-west traffic between servers is inspected on the hypervisor hosts. An attack trying to spread inside the network is detected at that point.
A security team writing signatures for its own app
Custom signatures are added for the in-house app on top of the ready ones. Signatures that raise false positives are excluded or have their actions changed.
Next-generation firewall capabilities, including threat protection
Detect only, or detect and prevent
Rules run in detect-only mode, which only raises events, or in detect-and-prevent mode, which drops or rejects traffic according to the signature setting.
Profiles by severity
Pick signatures by critical, high, medium, low and suspicious severity, and filter them by attack type, CVSS score, attack target and affected product.
Manage false positives
Exclude specific signatures or change their action to alert, drop or reject, and limit repeating events with threshold and rate filters.
Custom signatures
Add your own signatures alongside the built-in set for in-house applications and newly emerging threats.
Behaviour-based detection
Activity that deviates from normal traffic is flagged as an informational event with suspicious severity; flagged activity is not necessarily malicious.
Application-layer firewall
Alongside signature inspection, control traffic by application with application-based firewall rules.
Embedded security
Works with the firewall
Traffic blocked by a firewall rule never reaches inspection, so inspection is applied only to allowed traffic.
Targeted rule scope
Rules apply to specific virtual machine groups, source and destination IPs or CIDRs, direction and IP version.
Reject that ends the connection
With the reject action, packets are dropped and a reset is sent to both ends of a TCP connection, or an ICMP error for other protocols.
Intrusion Detection & Prevention pricing
Pricing is per gateway, and the package also includes the application-layer firewall. Contact us for pricing.
Learn more to get started
Software-Defined Networking
See the network model that stops an attacker from spreading inside.
Enterprise IT
See solutions for the infrastructure and security needs of enterprise IT teams.
Managed Support
See how routine operation of security settings can be handed over.