Anti-Bot Software Blade

Complete Anti-Bot Solution - integrated into Check Point Software Blade architecture

• Discover, stop and assess bot damages on a single gateway
• Unified and centralized management using Check Point SmartEvent
• Available on every gateway

Multi-Tier ThreatSpect™ Bot Detection Engine - the Anti-Bot Software Blade discovers infections by correlating multiple detection methods

• Reputation – evaluating IPs, URLs, and DNS addresses to determine whether outbound traffic is destined for known botnet Command and Control (C&C) sites.
• Patterns - detecting unique botnet family communication patterns (over multiple protocols such as HTTP, DNS and SMTP)
• Bot damages & actions by detecting attack types, such as Spam (leveraging outbound mail analysis) and Click fraud, as well as anomalies (irregular ports, protocols)

Inline bot prevention – block bot communications from infected hosts

• Support Inline and out-of-band deployment topologies
• Block bot specific communication to C&C sites to neutralize bot damages and ensure work continuity

Bot Information updates – providing automatic updates, using the ThreatCloud™ infrastructure, to the Anti-Bot Software Blade of the latest IP/URL/DNS reputation data and botnet communication patterns

• Eliminates administrator's need to constantly update policies or threat data bases

Forensics - Providing administrators and security teams with the information they need to analyze security events, investigate infections and assess damages

• Detailed infection information per malware type and/or infected users and machines
• Threat Wiki – extensive infection information (malware type, description and any available details such as executables run, used protocols etc.)
• Key bot actions – identify suspicious activities such as participating in DDoS attacks, self-distribution attempts, and participating in click fraud
• Packet capture – view data sent using complete per-session packet capture with SSL inspection

Malware reports and dashboards - infection summaries and trends to provide better visibility to organizational malware threats and risks

• View infected hosts statistics, malware types and activities, trends/changes vs. previous week/month, amount of data sent or received and more

Summary of infected hosts

Granular policy setting – detect and prevent suspicious actions per any user/machine

Hierarchical rule based engine providing administrators with complete flexibility

• Separate policy installation – minimize organizational risks by only updating specific Anti-Bot Blade policy (e.g. no need to also update Firewall policy)