Threat Prevention in Cato Networks: Configuring IPS, Malware & TLS

Threats to your network are no longer limited to known malware or signature-based exploits. To be honest, relying on old-school firewalls today is like using a screen door to stop a flood. Modern enterprises need dynamic protection that works in real time, at cloud scale. 

Cato Networks delivers advanced threat prevention capabilities—including IPS, Anti-Malware, and TLS Inspection—all managed through a unified cloud-native architecture.

This guide shows you how to enable and configure these security services in the latest Cato Management Application (CMA). We will also look at what to expect regarding operational behavior so you aren't caught off guard.

Start using Cato SASE today

Enabling Intrusion Prevention System (IPS)

Cato’s IPS engine runs at the network layer and is powered by both signature-based and behavioral detection.

To enable IPS:

1. Go to Security > Threat Protection > IPS
2. Toggle Enable IPS for the global policy or per-site level
3. Optionally, enable Alert Only mode for testing (logs without blocking)

You can also review threat severity and categories detected historically.
 

Enabling Anti-Malware Protection

Cato’s Anti-Malware engine inspects downloaded files and executables in real time. It uses both known threat signatures and zero-day detection via machine learning models.

Steps to enable:

1. Navigate to Security > Threat Protection > Anti-Malware
2. Toggle Enable Anti-Malware
3. Set action preferences: Block, Alert, or Allow with logging
4. Apply globally or per-site

Anti-Malware logs are viewable under Monitoring > Security Events.
 

Also Read: Strategies to Eliminate Network Downtime with Cato SASE’s Reliable Global Backbone

TLS Inspection: Deep Packet Visibility for Encrypted Traffic

TLS (SSL) Inspection allows Cato to decrypt and inspect HTTPS traffic to detect threats hidden inside encrypted sessions.

To enable TLS Inspection:

1. Go to Security > Threat Protection > TLS Inspection
2. Toggle Enable TLS Inspection
3. Upload your organization’s internal root certificate for endpoint trust
4. Select enforcement per rule or category (e.g., decrypt only specific app types)

⚠️ TLS inspection introduces overhead and may impact latency. It’s recommended to roll out in stages.

Monitoring Blocked Threats and Logs

After enabling threat prevention, you can monitor detections under:

• Monitoring > Security Events: IPS/Anti-Malware logs
• Analytics > Threat Dashboard: Aggregated threat categories, trends, and sources
• Monitoring > Audit Trail: Admin changes to policies

Use filters to sort events by source IP, severity, or blocked signature.
 

Real-World Use Case

An enterprise with distributed branch offices started seeing spikes in CPU usage at multiple endpoints. After enabling TLS inspection and Anti-Malware selectively on file-sharing categories, they discovered embedded ransomware downloads in seemingly harmless zip files.

Using Cato’s logs, the IT team quickly isolated affected endpoints and blocked the application category globally.

Also Read: Beyond VPN Limitations: Why Cato SASE Is the Better Choice for Remote Workforces

Best Practices for Rollout

• Start with Alert-Only Mode: Evaluate IPS/Anti-Malware impact before enforcement
• Whitelist business apps: Avoid false positives with trusted applications
• Use categories: Apply TLS inspection only to high-risk categories initially
• Test root certificate deployment: Validate browser and app compatibility
• Monitor logs daily: Especially in the first 7 days post-deployment

Conclusion

Threat prevention in Cato Networks is about more than just checking a box; it’s about creating a proactive defense that evolves with the threat. By leveraging the CMA, you can secure your global workforce without the complexity of managing multiple point products. We are dedicated to providing a security platform that is as agile as your business.

Book a call to reach our Cato SASE experts

FAQ Summary

Does TLS inspection affect all sites globally?

No. You can scope TLS policies per site or category.
 

Can users bypass TLS inspection?

Only if you exclude their subnet or device identity from policies.
 

What happens if a user’s browser doesn’t trust the inspection certificate?

They’ll receive HTTPS warnings. Ensure your root cert is deployed via GPO or MDM.
 

Are these threat prevention features licensed separately?

They’re included in most standard Cato SASE subscriptions, but confirm with your sales rep.
 

Can I integrate logs with SIEM platforms?

Yes. Cato supports log forwarding via Syslog and REST API.