Check Point UTM-1 Edge User Manual page 431

Table 91: Worm Catcher Fields
In this field...
Action
Track
HTTP-based worm
patterns list
Microsoft Networks
This category includes File and Print Sharing.
Microsoft operating systems and Samba clients rely on Common Internet File System
(CIFS), a protocol for sharing files and printers. However, this protocol is also widely used
by worms as a means of propagation.
You can configure how CIFS worms should be handled.
Chapter 13: Using SmartDefense
Do this...
Specify what action to take when an HTTP-based worm attack is
detected, by selecting one of the following:
•
Block. Block the attack.
•
None. No action. This is the default.
Specify whether to log HTTP-based worm attacks, by selecting one of
the following:
•
Log. Log the attack.
•
None. Do not log the attack. This is the default.
Select the worm patterns to detect.
SmartDefense Categories
417