What is the correct action to exclude one or more Threat Prevention Blades in a Blade exception rule?

To create an exception in the Check Point Threat Prevention policy that excludes one or more blades (e.g., IPS, Anti-Bot), the correct procedure is to use a custom Threat Prevention Profile. An administrator must first create a new profile or clone an existing one. Within this profile's settings, the specific blades that need to be excluded are configured by setting their "Activation" status to "Inactive". This custom profile is then applied as the "Action" in a new rule, which is typically placed at the top of the Threat Prevention rule base. Traffic matching this rule will bypass inspection by the blades that were set to "Inactive" in the applied profile.

Setting the action to "Bypass": "Bypass" is not a valid, selectable action within the Threat Prevention policy rule base. This action is used in other policy types, such as HTTPS Inspection. Setting the action to "Detect": The "Detect" action does not exclude a blade. The blade still inspects the traffic and generates a log for any threats found, but it does not block them. Setting the action to "Accept": "Accept" is an action belonging to the Access Control (Firewall) policy layer. It is not a valid action within the Threat Prevention policy.

1. Check Point R81.10 Threat Prevention Administration Guide:

Page 38, "Creating Exceptions for Threat Prevention": "To create an exception, add a rule to the top of the Threat Prevention Rule Base. In the rule, specify the traffic that you want to be exempt from inspection. Then, in the Action column, select a Threat Prevention Profile in which some or all protections are inactive." This directly supports the explanation that using a profile with inactive blades is the correct method.

2. Check Point R81.10 Security Management Administration Guide:

Page 413, "The Threat Prevention Rule Base": This section describes the columns of the Threat Prevention policy. It clarifies that the "Action" column contains the name of the Threat Prevention Profile applied to matching traffic. This confirms that the rule's action is fundamentally a profile, and any exclusions must be configured within that profile.