name that security profile

[jdprovine]

I am looking for a more descriptive name for my security profile ? I have vulnerablity protection, anit-virus, anti-spyware and wildfire included on the profile that I have added to a majority of my rule. currently it is name All PE alert

[Mick_Ball]

Hows about the “Brexit” profile...

looks and sounds impressive but deep down its actually causes more grief than its worth.....

Topical i know.......

let me know if i can be of any further assistance.

[BPry]

@jdprovine,

WhateverOrg-Default-Profile - Applied to most security rules. 

ICanSeeYou - Logging rule that litterally logs everything

HIPAA - Special profile built out for HIPAA Servers

Server - Special Profile built out for Datacenter Servers

Just a few examples. The name itself doesn't really matter as long as you, and anyone else that builds policies, actually know what it does. You could you ThouShallNotPass and it doesn't matter as long as everyone that needs to know what ThouShallNotPass is used for is in the loop. 

[jdprovine]

@BPry @Mick_Ball

Yea the name that it is currently set to is "Alert on PE files" doesn't make sense to me when you are  doing antiviru, antispyware, vulnerablity and wildfire. I am trying to find what I believe is a better name, we have the free version of widlfire which only alerts on PE files and that is what that name makes me think, that it is only being used for wildfire

[jdprovine]

@Mick_Ball

Is Brexit code for breaks it? If it is as always you crack me up

[BPry]

@jdprovine,

More then likely it was only configured as a Wildfire policy group to begin with. Then as they moved to the PA in earnest they just kept adding additional profiles to that group. I'd revisit the name and just call it something that appears as "this is our default profile", however that actually takes shape as the name goes. 

[jdprovine]

@BPry

No actually the other way around it was called logall originally, I added wildfire later and then it was renamed last week to the name I mentioned which to me only addressed the wildfire portion of the profile not the other aspects. But i can't think of another name that would cover all and not be a huge name LOL. So I was hoping someone would have a good name idea for me LOL

So you agree with me that alert on PE files sounds like wildfire

[BPry]

@jdprovine,

Ya, I wouldn't assume that this was your 'general' profile group. I would have actually assumed that this was a data filtering profile just looking at the name, not even a WildFire profile. 

[jdprovine]

@BPry

So are you saying that "alert on PE files" makes it sound like it is doing only PE files and  not doing antivirus, anitspyware, vulnerablity and wildfire but only PE

[Mick_Ball]

@jdprovine, no... sorry... nothing to do with breaks it... its a UK topical joke, probably wasted here....

laters....

[jdprovine]

@BPry @Mick_Ball

What if I called it security profile? Or better yet anti_bad_stuff_profile

[jdprovine]

@BPry @MickBall  @reaper

Round two

So we have a  group security profile, named Alert on PE files. The profiles associated with this group profile are Antivirus - set to block, Antispyware - set to block, Vulnerability protection, File blocking profile - set to Alert for PE Files and wildfire analysis profile. So the strategy was to name it for the only profile that was set to alert. Let me know if that makes sense and the best way to name it Here is a pic of the group profile config

[Remo]

@jdprovine

What about the crypto version here 😛

SPG_BL-AV-AS_LO-VUL-FBPE_WFPE

• SPG = Security Profile Group
• BL-AV-AS = Block Antivirus and Antispyware
• LO-VUL-FBPE = Log Only Vulnerabilities and File Blocking PE Files
• WFPE = Wildfire Forwarding for PE files

But you probably should find a name (mentionned by @BPry) that somehow fits your environment and where you and the others that create policies know what it means.

Is this your profile group that you use for most of the policies or a profile for some specific servers/protocols/connections?

[jdprovine]

@Remo

Yes this is the profile group that is used for a majority of our rules.  I think the name is too narrow but at this point I can't think of a better one that covers all of what is going on in the group profile without it being too long