# cp_mgmt_threat_profile – Manages threat-profile objects on Check Point over Web Services API

New in version 2.9.

- Synopsis
- Parameters
- Examples
- Return Values
- Status

## Synopsis

- Manages threat-profile objects on Check Point devices including creating, updating and removing objects.
- All operations are performed over Web Services API.

## Parameters

Parameter | Choices/Defaults | Comments
--- | --- | ---
activate_protections_by_extended_attributes list |  | Activate protections by these extended attributes.
| category string |  | IPS tag category name.
| name string |  | IPS tag name.

active_protections_performance_impact
string

Choices:
- high
- medium
- low
- very_low

Protections with this performance impact only will be activated in the profile.

active_protections_severity
string

Choices:
- Critical
- High
- Medium or above
- Low or above

Protections with this severity only will be activated in the profile.

anti_bot
boolean

Choices:
- no
- yes

Is Anti-Bot blade activated.

anti_virus
boolean

Choices:
- no
- yes

Is Anti-Virus blade activated.

auto_publish_session
boolean

Choices:
- no
- yes

Publish the current session if changes have been performed after task completes.

color
string

Choices:
- aquamarine
- black
- blue
- crete blue
- burlywood
- cyan
- dark green
- khaki
- orchid
- dark orange
- dark sea green
- pink
- turquoise
- dark blue
- firebrick
- brown
- forest green
- gold
- dark gold
- gray
- dark gray
- light green
- lemon chiffon
- coral
- sea green
- sky blue
- magenta
- purple
- slate blue
- violet red
- navy blue
- olive
- orange
- red
- sienna
- yellow

Color of the object. Should be one of existing colors.

comments string |  | Comments string.

confidence_level_high
string

Choices:
- Inactive
- Ask
- Prevent
- Detect

Action for protections with high confidence level.

confidence_level_low
string

Choices:
- Inactive
- Ask
- Prevent
- Detect

Action for protections with low confidence level.

confidence_level_medium
string

Choices:
- Inactive
- Ask
- Prevent
- Detect

Action for protections with medium confidence level.

deactivate_protections_by_extended_attributes list |  | Deactivate protections by these extended attributes.
| category string |  | IPS tag category name.
| name string |  | IPS tag name.

details_level
string

Choices:
- uid
- standard
- full

The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed representation of the object.

ignore_errors
boolean

Choices:
- no
- yes

Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored.

ignore_warnings
boolean

Choices:
- no
- yes

Apply changes ignoring warnings.

indicator_overrides list |  | Indicators whose action will be overridden in this profile.

action
string

Choices:
- Inactive
- Ask
- Prevent
- Detect

The indicator's action in this profile.

| indicator string |  | The indicator whose action is to be overridden.

ips
boolean

Choices:
- no
- yes

Is IPS blade activated.

ips_settings dictionary |  | IPS blade settings.

exclude_protection_with_performance_impact
boolean

Choices:
- no
- yes

Whether to exclude protections depending on their level of performance impact.

exclude_protection_with_performance_impact_mode
string

Choices:
- very low
- low or lower
- medium or lower
- high or lower

Exclude protections with this level of performance impact.

exclude_protection_with_severity
boolean

Choices:
- no
- yes

Whether to exclude protections depending on their level of severity.

exclude_protection_with_severity_mode
string

Choices:
- low or above
- medium or above
- high or above
- critical

Exclude protections with this level of severity.

newly_updated_protections
string

Choices:
- active
- inactive
- staging

Activation of newly updated protections.

malicious_mail_policy_settings dictionary |  | Malicious Mail Policy for MTA Gateways.

add_customized_text_to_email_body
boolean

Choices:
- no
- yes

Add customized text to the malicious email body.

add_email_subject_prefix
boolean

Choices:
- no
- yes

Add a prefix to the malicious email subject.

add_x_header_to_email
boolean

Choices:
- no
- yes

Add an X-Header to the malicious email.

email_action
string

Choices:
- allow
- block

Block - block the entire malicious email<br>Allow - pass the malicious email and apply email changes (like, remove attachments and links, add x-header, etc...).

| email_body_customized_text string |  | Customized text for the malicious email body.<br> Available predefined fields,<br> $verdicts$ - the malicious/error attachments/links verdict.
| email_subject_prefix_text string |  | Prefix for the malicious email subject.
| failed_to_scan_attachments_text string |  | Replace attachments that failed to be scanned with this text.<br> Available predefined fields,<br> $filename$ - the malicious file name.<br> $md5$ - MD5 of the malicious file.
| malicious_attachments_text string |  | Replace malicious attachments with this text.<br> Available predefined fields,<br> $filename$ - the malicious file name.<br> $md5$ - MD5 of the malicious file.
| malicious_links_text string |  | Replace malicious links with this text.<br> Available predefined fields,<br> $neutralized_url$ - neutralized malicious link.

remove_attachments_and_links
boolean

Choices:
- no
- yes

Remove attachments and links from the malicious email.

send_copy
boolean

Choices:
- no
- yes

Send a copy of the malicious email to the recipient list.

| send_copy_list list |  | Recipient list to send a copy of the malicious email.
name string / required |  | Object name.
overrides list |  | Overrides per profile for this protection.

action
string

Choices:
- Threat Cloud: Inactive
- Detect
- Prevent <br> Core: Drop
- Inactive
- Accept

Protection action.

capture_packets
boolean

Choices:
- no
- yes

Capture packets.

| protection string |  | IPS protection identified by name or UID.

track
string

Choices:
- none
- log
- alert
- mail
- snmp trap
- user alert
- user alert 1
- user alert 2

Tracking method for protection.

state
string

Choices:
- present ←
- absent

State of the access rule (present or absent). Defaults to present.

tags list |  | Collection of tag identifiers.

threat_emulation
boolean

Choices:
- no
- yes

Is Threat Emulation blade activated.

use_extended_attributes
boolean

Choices:
- no
- yes

Whether to activate/deactivate IPS protections according to the extended attributes.

use_indicators
boolean

Choices:
- no
- yes

Indicates whether the profile should make use of indicators.

version string |  | Version of checkpoint. If not given one, the latest version taken.

wait_for_task
boolean

Choices:
- no
- yes ←

Wait for the task to end. Such as publish task.

## Examples

    - name: add-threat-profile
      cp_mgmt_threat_profile:
        active_protections_performance_impact: low
        active_protections_severity: low or above
        anti_bot: true
        anti_virus: true
        confidence_level_high: prevent
        confidence_level_medium: prevent
        ips: true
        ips_settings:
          exclude_protection_with_performance_impact: true
          exclude_protection_with_performance_impact_mode: high or lower
          newly_updated_protections: staging
        name: New Profile 1
        state: present
        threat_emulation: true

    - name: set-threat-profile
      cp_mgmt_threat_profile:
        active_protections_performance_impact: low
        active_protections_severity: low or above
        anti_bot: true
        anti_virus: false
        comments: update recommended profile
        confidence_level_high: prevent
        confidence_level_low: prevent
        confidence_level_medium: prevent
        ips: false
        ips_settings:
          exclude_protection_with_performance_impact: true
          exclude_protection_with_performance_impact_mode: high or lower
          newly_updated_protections: active
        name: New Profile 1
        state: present
        threat_emulation: true

    - name: delete-threat-profile
      cp_mgmt_threat_profile:
        name: New Profile 1
        state: absent

## Return Values

Common return values are documented here, the following are the fields unique to this module:

Key | Returned | Description
--- | --- | ---
cp_mgmt_threat_profile dictionary | always, except when deleting the object. | The checkpoint object created or updated.

## Status

- This module is not guaranteed to have a backwards compatible interface. [preview]
- This module is maintained by the Ansible Community. [community]

### Authors

- Or Soffer (@chkp-orso)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.