Threat Intelligence Gateway leverages Sangfor's active detection engine along with extensive threat intelligence in the existing network to detect and block threat traffic in real time. This ensures that all traffic is detected and identified by Threat Intelligence Gateway before Athena NGFW forwards the traffic. Therefore, malicious traffic can be blocked before it is forwarded, and asset security is protected.

Step 1.Integrate Athena NGFW with cloud products. For more information, see the "Product Integration" section.

Step 2.After Athena NGFW is integrated with the cloud products, you further need to properly configure botnet detection and content security policies to ensure that Threat Intelligence Gateway can take effect. After the botnet detection policy is enabled, Threat Intelligence Gateway will send the domain names that cannot be identified locally to the extensive threat intelligence library in the cloud for security detection. After the content security policy is enabled, Threat Intelligence Gateway will send the file features that cannot be identified locally to the extensive threat intelligence library in the cloud for security detection.

If a required security policy is not configured, a message will appear on the Threat Intelligence Gateway page, as shown in the following figure. You can click Configure Now in the message to go to the Policies page to configure the required security policy.

The following figure shows a security policy for which botnet detection is enabled. The Source and Destination columns display the source and destination areas and IP addresses. The Detection and Response column displays Botnet Detection. When you move the pointer over Botnet Detection, you can view that the action is Deny.

After Athena NGFW detects threat intelligence, the Block Summary section of the Threat Intelligence Gateway page will summarize the detection results, such as the block counts and the latest 30 blocked requests. You can click View Logs in the upper-right corner of the Block Summary section to go to the Security Logs tab to view the detailed threat logs. On the Security Logs tab, Threat Intelligence Gateway in the Detection Type column indicates that the threat log is detected by Threat Intelligence Gateway.