cp_mgmt_threat_profile

Manages threat-profile objects on Check Point over Web Services API through native controller HTTPAPI with owned sessions

Collection: check_point.mgmt

Full Name: check_point.mgmt.cp_mgmt_threat_profile

Controller module — runs on the local controller, not on remote hosts.

Synopsis

Manages threat-profile objects on Check Point over Web Services API through native controller HTTPAPI with owned sessions

Parameters

Name	Type	Required	Default	Description
activate_protections_by_extended_attributes	list			Activate protections by these extended attributes.
active_protections_performance_impact	str			Protections with this performance impact only will be activated in the profile.
active_protections_severity	str			Protections with this severity only will be activated in the profile.
advanced_dns_settings	dict			Advanced DNS Settings.
anti_bot	bool			Is Anti-Bot blade activated.
anti_virus	bool			Is Anti-Virus blade activated.
auto_publish_session	bool		`false`	Publish this owned session explicitly after the operation; default false.
color	str			Color of the object. Should be one of existing colors.
comments	str			Comments string.
confidence_level_high	str			Action for protections with high confidence level.
confidence_level_low	str			Action for protections with low confidence level.
confidence_level_medium	str			Action for protections with medium confidence level.
deactivate_protections_by_extended_attributes	list			Deactivate protections by these extended attributes.
details_level	str			The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed representation of the object.
ignore_errors	bool			Apply changes ignoring errors. You won’t be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.
ignore_warnings	bool			Apply changes ignoring warnings.
indicator_overrides	list			Indicators whose action will be overridden in this profile.
ips	bool			Is IPS blade activated.
ips_settings	dict			IPS blade settings.
malicious_mail_policy_settings	dict			Malicious Mail Policy for MTA Gateways. Available from R80.20.M1 management version.
name	str	yes		Object name.
overrides	list			Overrides per profile for this protection.
scan_malicious_links	dict			Scans malicious links (URLs) inside email messages.
state	str		`present`	Desired object presence.
tags	list			Collection of tag identifiers.
threat_emulation	bool			Is Threat Emulation blade activated.
threat_extraction	bool			Is Threat Extraction blade activated.
use_extended_attributes	bool			Whether to activate/deactivate IPS protections according to the extended attributes.
use_indicators	bool			Indicates whether the profile should make use of indicators.
version	str			Management API version path; omitted uses the default API version.
wait_for_task	bool		`true`	Wait for returned asynchronous task identifiers; default true.
wait_for_task_timeout	int		`30`	Polling deadline in minutes; default 30, negative values use 30, maximum 1440.
zero_phishing	bool			Is Zero Phishing blade activated.

Example

yaml

- name: add-threat-profile
  check_point.mgmt.cp_mgmt_threat_profile:
    active_protections_performance_impact: low
    active_protections_severity: Low or above
    anti_bot: true
    anti_virus: true
    confidence_level_high: Prevent
    confidence_level_medium: Prevent
    ips: true
    ips_settings:
      exclude_protection_with_performance_impact: true
      exclude_protection_with_performance_impact_mode: high or lower
      newly_updated_protections: staging
    name: New Profile 1
    state: present
    threat_emulation: true

- name: set-threat-profile
  check_point.mgmt.cp_mgmt_threat_profile:
    active_protections_performance_impact: low
    active_protections_severity: Low or above
    anti_bot: true
    anti_virus: false
    comments: update recommended profile
    confidence_level_high: Prevent
    confidence_level_low: Prevent
    confidence_level_medium: Prevent
    ips: false
    ips_settings:
      exclude_protection_with_performance_impact: true
      exclude_protection_with_performance_impact_mode: high or lower
      newly_updated_protections: active
    name: New Profile 1
    state: present
    threat_emulation: true

- name: delete-threat-profile
  check_point.mgmt.cp_mgmt_threat_profile:
    name: New Profile 1
    state: absent