> Source: [sk167109](https://support.checkpoint.com/results/sk/sk167109) # sk167109 - Autonomous Threat Prevention Management Integration Release Updates | Property | Value | |----------|-------| | Solution ID | sk167109 | | Date Created | 2020-06-10 | | Last Modified | 2026-07-19 | | Technical Level | General | | Products | Security Gateway, Security Management Server | | Versions | R82.10, R82, R81.20, R81.10 (EOS), R82.10, R82, R81.20, R81 (EOS), R81.10 (EOS), R81 (EOS) | | OS | Gaia | ## Solution Show the Entire Article **Introduction \| Availability \| Released Takes \| Manual Installation \| List of Resolved Issues** Introduction {#Introduction} ---------------------------- **Autonomous Threat Prevention Management (ATPM):** * New Threat Prevention management, that uses Smart Cyber Policy from the cloud. * Provides out of the box Threat Prevention profiles based on business \& IT security needs. * Easy assignment of policy profile that is tailored to your needs. * Automatic update of Threat Prevention policy profiles to protect against the latest cyber threats using the latest technologies. * Zero day-to-day maintenance required from the administrator, while maintaining optimal security. Administrators still have manual configuration capabilities. Example screenshot from SmartConsole: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk168074/ATM202111062115071.jpg) The Autonomous Threat Prevention Management Integration packages are installed automatically on all relevant Check Point devices when Automatic Update downloads are enabled (see [sk175504](https://support.checkpoint.com/results/sk/sk175504), section 2-B). If Automatic Updates are disabled, you can install Autonomous Threat Prevention Management Integration packages manually using the steps below. Availability {#Availability} ---------------------------- > |--------|--------------|-------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------| > | Update | Release Date | GOT_TPCONF | GOT_TPCONF_MGMT | GOT_MGMT | DC_INFRA | > | 29 | 19 Jul 2026 | [![](https://sc1.checkpoint.com/sc/images/download-m.png)](https://support.checkpoint.com/results/download/144366) (Take 163) | [![](https://sc1.checkpoint.com/sc/images/download-m.png)](https://support.checkpoint.com/results/download/140866) (Take 41) | [![](https://sc1.checkpoint.com/sc/images/download-m.png)](https://support.checkpoint.com/results/download/142932) (Take 139) | [![](https://sc1.checkpoint.com/sc/images/download-m.png)](https://support.checkpoint.com/results/download/121166) (Take 30) | > > Where: > > * *GOT_TPCONF_MGMT* , *GOT_MGMT* , and *DC_INFRA* - Packages for a Management Server > * *GOT_TPCONF* - A package for Security Gateways / Cluster Members / Scalable Platform Security Groups > Released Takes {#Released Takes} -------------------------------- Show / Hide Released Takes |-------------|-------------|-----------------|------| | Date | Description | Package | Take | | 19 Jul 2026 | Update 29 | GOT_TPCONF | 163 | | 26 Apr 2026 | Update 28 | GOT_MGMT | 139 | | 01 Mar 2026 | Update 28 | GOT_TPCONF_MGMT | 41 | | 20 Nov 2025 | Update 27 | GOT_MGMT | 137 | | 13 Aug 2025 | Update 26 | GOT_TPCONF | 158 | | 05 Jan 2025 | Update 25 | GOT_TPCONF | 137 | | 05 Jan 2025 | Update 25 | GOT_TPCONF_MGMT | 39 | | 05 Jan 2025 | Update 25 | GOT_MGMT | 136 | | 03 Mar 2024 | Update 24 | GOT_TPCONF | 128 | | 03 Mar 2024 | Update 24 | GOT_TPCONF_MGMT | 39 | | 17 Dec 2023 | Update 23 | GOT_TPCONF | 127 | | 10 Dec 2023 | Update 22 | GOT_TPCONF | 124 | | 10 Dec 2023 | Update 22 | GOT_MGMT | 126 | | 05 Sep 2023 | Update 21 | GOT_TPCONF | 120 | | 05 Sep 2023 | Update 21 | GOT_MGMT | 116 | | 02 Apr 2023 | Update 18 | GOT_TPCONF | 112 | | 25 Jan 2023 | Update 17 | GOT_MGMT | 108 | | 08 Jan 2023 | Update 16 | GOT_TPCONF | 111 | | 08 Jan 2023 | Update 16 | GOT_MGMT | 103 | | 14 Jun 2022 | Update 15 | GOT_TPCONF | 107 | | 14 Jun 2022 | Update 15 | GOT_MGMT | 101 | | 20 Mar 2022 | Update 14 | GOT_MGMT | 99 | | 20 Mar 2022 | Update 14 | GOT_TPCONF | 104 | | 20 Mar 2022 | Update 14 | DC_INFRA | 30 | | 09 Dec 2021 | Update 13 | GOT_MGMT | 95 | | 09 Dec 2021 | Update 13 | GOT_TPCONF | 97 | | 09 Dec 2021 | Update 13 | DC_INFRA | 34 | | 03 May 2021 | Update 11 | GOT_MGMT | 91 | | 03 May 2021 | Update 11 | GOT_TPCONF | 91 | | 25 Feb 2021 | Update 9 | GOT_MGMT | 82 | | 25 Feb 2021 | Update 9 | GOT_TPCONF | 86 | | 25 Jan 2021 | Update 8 | GOT_MGMT | 80 | | 25 Jan 2021 | Update 8 | GOT_TPCONF | 84 | | 25 Jan 2021 | Update 8 | DC_INFRA | 26 | | 03 Dec 2020 | Update 7 | GOT_MGMT | 32 | | 03 Dec 2020 | Update 7 | GOT_TPCONF | 78 | | 03 Dec 2020 | Update 7 | DC_INFRA | 22 | | 03 Nov 2020 | Update 6 | GOT_MGMT | 74 | | 03 Nov 2020 | Update 6 | GOT_TPCONF | 75 | | 03 Nov 2020 | Update 6 | DC_INFRA | 21 | | 12 Oct 2020 | Update 5 | GOT_MGMT | 72 | | 01 Oct 2020 | Update 4 | GOT_MGMT | 71 | | 01 Oct 2020 | Update 4 | GOT_TPCONF | 30 | | 01 Oct 2020 | Update 4 | DC_INFRA | 63 | | 10 Sep 2020 | Update 3 | GOT_MGMT | 65 | | 10 Sep 2020 | Update 3 | GOT_TPCONF | 52 | | 13 Aug 2020 | Update 2 | GOT_TPCONF | 50 | | 15 Jul 2020 | Update 1 | GOT_MGMT | 56 | | 15 Jul 2020 | Update 1 | GOT_TPCONF_MGMT | 25 | | 15 Jul 2020 | Update 1 | GOT_TPCONF | 35 | | 15 Jul 2020 | Update 1 | DC_INFRA | 18 | Manual Installation (Offline) {#Offline} ---------------------------------------- Show / Hide Instructions 1. On the Security Gateway / each Cluster Member / Scalable Platform Security Group, install the Autonomous Threat Prevention package ***GOT_TPCONF***): 1. Prepare a temporary directory: 1. Connect to the command line on the Security Gateway / each Cluster Member / Scalable Platform Security Group. 2. Log in to the Expert mode: `expert` 3. Create a temporary directory: * On the Security Gateway / each Cluster Member: `mkdir -v /var/log/GwAtpUpdate` * On the Scalable Platform Security Group: `g_all mkdir -v /var/log/GwAtpUpdate` 2. Get the required Autonomous Threat Prevention package: 1. Download the **GOT_TPCONF** package from the "Availability" section above to your computer. 2. Copy the package from your computer to the Security Gateway / each Cluster Member / Scalable Platform Security Group to the temporary directory */var/log/GwAtpUpdate/*). 3. Get the **Installation script**: 1. Download the [installItpDarwin.sh](http://downloads.checkpoint.com/fileserver/ID/105729/FILE/installItpDarwin.sh) script to your computer. 2. Copy the Installation script from your computer to the Security Gateway / each Cluster Member / Scalable Platform Security Group to the temporary directory */var/log/GwAtpUpdate/*). 4. Go to the temporary directory: * On the Security Gateway / each Cluster Member: `cd /var/log/GwAtpUpdate ; pwd` * On the Scalable Platform Security Group: `g_all cd /var/log/GwAtpUpdate ; g_all pwd` 5. Assign the "execute" permission to the Installation script: * On the Security Gateway / each Cluster Member: `chmod -v +x installItpDarwin.sh` * On the Scalable Platform Security Group: `g_all chmod -v +x installItpDarwin.sh` 6. Run the installation script: * On the Security Gateway / each Cluster Member: `./installItpDarwin.sh --local $(pwd)` * On the Scalable Platform Security Group: `g_all ./installItpDarwin.sh --local $(pwd)` When finished, the script shows "`Finished`". 2. On the Management Server, install the Autonomous Threat Prevention packages (***GOT_TPCONF_MGMT*** , ***GOT_MGMT*** , and ***DC_INFRA***): 1. Prepare a temporary directory: 1. Connect to the command line on the Management Server. 2. Log in to the Expert mode. 3. Create a temporary directory: `mkdir -v /var/log/MgmtAtpUpdate` 2. Get the required Autonomous Threat Prevention packages: 1. Download the ***GOT_TPCONF_MGMT*** , ***GOT_MGMT*** , and ***DC_INFRA*** packages from the "Availability" section above to your computer. 2. Copy the packages from your computer to the Management Server to the temporary directory */var/log/MgmtAtpUpdate/*). 3. Get the **Installation script**: 1. Download the [installItpDarwin.sh](http://downloads.checkpoint.com/fileserver/ID/105729/FILE/installItpDarwin.sh) script to your computer. 2. Copy the Installation script from your computer to the Management Server to the temporary directory */var/log/MgmtAtpUpdate/*). 4. Go to the temporary directory: `cd /var/log/MgmtAtpUpdate` 5. Assign the "execute" permission to the Installation script: `chmod +x installItpDarwin.sh` 6. Run the Installation script: `./installItpDarwin.sh --local $(pwd)` When finished, the script shows "`Finished`" and a list of the installed packages. 7. In SmartConsole \> **Security Policies** view \> Threat Prevention, "Autonomous Threat Prevention" appears. 3. In SmartConsole, enable Autonomous Threat Prevention in the Security Gateway / Cluster Object: 1. Connect with SmartConsole to the Management Server. 2. From the left navigation panel, click the **Gateways \& Servers** view. 3. Double-click the Security Gateway / Cluster object. 4. From the left tree, click **General Properties**. 5. In the lower pane, click the **Threat Prevention** tab. 6. Select **Autonomous Threat Prevention**. 7. Click **OK**. 4. In SmartConsole, create an Autonomous Threat Prevention policy (if you already have a Threat Prevention policy package, skip to Step 5): 1. In SmartConsole, in the top left corner, click the Menu icon and click **Manage policies and layers**. 2. In the **Manage policies and layers** window, click **New**. 3. Enter a name for the policy package. 4. On the **General** page \> **Policy types** section, select **Threat Prevention** (you can select more policy types if required). 5. Click OK. 6. In SmartConsole, from the left navigation panel, click the **Security Policies** view. 7. In the **Infinity Threat Prevention** section, click **Policy**. 8. From the top drop-down list with the five pre-defined profiles, select the required profile. 9. Click **OK**. 5. In SmartConsole, install the Autonomous Threat Prevention policy: 1. In SmartConsole, from the top, click **Install Policy**. 2. Select **Threat Prevention**. 3. Select the applicable Security Gateway / Cluster objects. **Note** - The Autonomous Threat Prevention policy is installed on Security Gateways / Clusters with the Infinity Threat Prevention enabled. Security Gateways / Clusters without Infinity Threat Prevention enabled, receive the traditional Threat Prevention Policy. 4. Click **Install**. 5. Test the Threat Prevention policy - download a malicious file (for example, EICAR) through the Security Gateway / Cluster. The Security Gateway / Cluster must prevent the download and generate the corresponding log. List of Resolved Issues and New Features per Autonomous Threat Prevention Management Update {#List of resolved issues per HotFix} --------------------------------------------------------------------------------------------------------------------------------- |------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ID | Description | | Update 29 - Gradual deployment from 19 Jul 2026 || | ODU-4435 | Disabled TPCONF on the VSNext Virtual Switch. | | Update 28 - Gradual deployment from 26 Apr 2026 || | ODU-4030 | The "*An illegal reflective access operation has occurred*" warning is displayed, even though Threat Prevention policy installation on ElasticXL Cluster succeeded. | | Update 28 - Gradual deployment from 01 Mar 2026 || | ODU-3467 | Cosmetic fixes. | | Update 27 (20 November 2025) || | ODU-3235 | Minor fixes. | | Update 26 (13 August 2025) || | ODU-2594 | UPDATE: Enhanced file type classification in the Anti-Virus blade. | | ODU-2594 | Minor cosmetic updates. | | Update 25 (05 January 2025) || | ODU-1579 | UPDATE: Enhanced file type classification in the Anti-Virus blade. | | ODU-1579 | UPDATE: Improved DNS settings in the Autonomous Threat Prevention policy. | | ODU-1579 | Minor cosmetic updates. | | Update 24 (03 March 2024) || | ODU-1476 | UPDATE: Added ability to enable DNS over the HTTPs deactivation option (In R82, available for Early Availability program customers). | | ODU-1476 | In a rare scenario, policy installation may fail on the newly created Security Gateways. | | Update 23 (17 December 2023) || | ODU-1460 | UPDATE: Policy installation may fail when using updatable objects and ATPM is enabled. | | Update 22 (10 December 2023) || | ODU-1248 | UPDATE: Added a new profile - "Monitor". It can be used to start working with Autonomous Threat Prevention in Detect mode. Refer to the "Help me decide" option for more information. | | Update 21 (05 September 2023) || | ODU-1170 | UPDATE: Enhanced classification and configuration process to support the new file types: one and xar. | | ODU-1170 | An issue with the IPS S1 License in ATPM. | | Update 18 (02 April 2023) || | ODU-898 | UPDATE: Added several more IPS protections to Recommended For Perimeter ATPM profile. | | Update 17 (25 January 2023) || | ODU-851 | Enhanced stability. | | Update 16 (8 January 2023) || | ODU-603 | Added various detection enhancements and code improvements. | | Update 15 (14 June 2022) || | ODU-385 | NEW: Web Zero-day Phishing Prevention is now available for all R81.20 EA customers with an NGTX license. * The protection is automatically enabled in the Autonomous Perimeter and Strict Security profiles. * The new Configuration Overview panel prompts fixing potential protection misconfigurations. | | Update 14 (20 March 2022) || | ODU-283 | In some scenarios, Blade Global Exceptions may not be optimized for CPU consumption. | | ODU-283 | Network feeds and Updatable objects are not supported in ATPM, including as part of Network Groups. | | ODU-283 | When installing policy with Network Feeds or Updatable Objects which are part of Network Groups or stand-alone, an obscure message may be displayed. | | Update 13 (15 July 2021) || | ODU-154 | UPDATE: Prevention of [Codecov supply chain attack](https://blog.sonatype.com/what-you-need-to-know-about-the-codecov-incident-a-supply-chain-attack-gone-undetected-for-2-months) is automatically enabled for all policy profiles of Autonomous Threat Prevention. | | ODU-154 | UPDATE: Sandbox enhanced, with new heuristics for [Qbot](https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/) malware detection and improved AI-based detection capabilities for executable files. | | ODU-154 | UPDATE: Added new IPS protections for detection and prevention of malicious usage of XML macros, like [Zloader](https://blog.checkpoint.com/2020/06/04/coronavirus-update-not-the-type-of-cv-youre-looking-for/), [Qbot](https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/), and [Icedid](https://research.checkpoint.com/2021/melting-ice-tracking-icedid-servers-with-a-few-simple-steps/) | | ODU-154 | The License absence warning may be shown to NGTP licensed users. | | Update 11 (03 May 2021) || | ODU-112 | NEW: Added customization capabilities to support RTF files. All Gateways with enabled Sanitization will clean RTF files from potentially malicious content. | | ODU-112 | NEW: Automatic optimization of a Threat Prevention policy according to the appliance RAM usage during policy installation: for appliances with a lack of RAM, Autonomous Threat Prevention Management will automatically disable Sanitization technology. An administrator will be notified and can check the status under the "Device and information" section | | ODU-112 | NEW: In Autonomous Threat Prevention Settings menu, it is now possible to control if the policy package is optimized for rapid file delivery (unknown files delivered after the initial scan, before the final verdict from Sandbox) or for maximum security (files delivered after the final verdict from Sandbox). | | ODU-112 | UPDATE: Adjusted suffix of sanitized files (".cleaned" by default) | | ODU-112 | UPDATE: Threat Emulation Sandbox is enhanced with advanced anti-evasion techniques to improve prevention of malware that tries to detect emulation and hides its malicious activities. | | ODU-112 | UPDATE: Microsoft Exchange Zero-days exploits. On March 2, 2021, Microsoft shared details on multiple severe vulnerabilities (CVE2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065) targeting Microsoft Exchange Servers. Microsoft reported that those vulnerabilities have been detected as exploited.The following IPS protections have been released for the relevant vulnerabilities: * * * Microsoft Exchange Server Remote Code Execution (CVE-2021-26855; CVE-2021-27065) * Microsoft Exchange Server Remote Code Execution (CVE-2021-26857; CVE-2021-26858) | | Update 9 (25 February 2021) || | ODU-89 | Added various detection enhancements and code improvements. | | Update 8 (25 January 2021) || | ODU-82 | NEW: * Profile Security Settings Override and Sanitization Preferences are now available in the Settings tab. * Added "Share Feedback" component at the bottom of the screen. | | Update 7 (03 December 2020) || | ODU-76 | Added various detection enhancements and code improvements. | | Update 6 (03 November 2020) || | TPM-2286, TPM-2552, TPM-2565 | NEW: Added ability to configure via Management API, Sandbox (Threat Emulation) and Sanitization (Threat Extraction). Refer to [sk169952](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk169952). | | TPM-2558 | Search in the Deployment Dashboard may not filter the result. | | Update 5 (12 October 2020) || | TPM-2321 | Policy statistics may not be visible. | | Update 4 (01 October 2020) || | PMTR-58049 | In some scenarios, policy installation on Virtual System may fail when ITPM is enabled. | | Update 3 (10 September 2020) || | TPP-613 | NEW: Added the File Protections tab. It provides detailed visibility of file type actions per profile and an option to override default profile actions. | | Update 2 (13 August 2020) || | - | Improvements in IPS Profile settings. | | Update 1 (15 July 2020) || | - | UPDATE: Added Sandboxing support for the following MacOS file types: app, dmg and pkg. By default, these file types will be sandboxed by all the Gateways. | | - | UPDATE: Added File Reputation and Sandboxing support for the following archive types: RPM, WIM, CHM, LZH, MSI, ARJ, CPIO, AR, CramFS, QCW2, UDF. By default, these file types will be inspected by all the Gateways. | {#limitations-Table} --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content