IOC Feed "Prevent" Action Fails to Block Emails on Quantum Security Gateways Running Gaia R81.20

Product

Anti-Bot, Anti-Virus, Threat Prevention

Version

R81.20

Last Modified

2026-07-23

Symptoms

• Indicator of Compromise (IOC) feeds with Action: Prevent do not block emails as expected on Quantum Security Gateways.
• The issue occurs across multiple Quantum Security Gateways, not limited to a single device.
• The problem is consistently reproducible: emails from addresses listed in the IOC feed are not blocked.
• IOC feeds work as expected on Quantum Security Gateways running Gaia R81.10, but fail to block on Gaia R81.20.
• IOC entries are present and visible on the Quantum Security Gateways, and the correct Threat Prevention profiles are applied.
• No blocks are observed in logs for Gaia R81.20, while Gaia R81.10 shows successful blocks for the same IOC entries.

Solution

This problem was fixed. The fix is included in:

• Jumbo Hotfix Accumulator for R81.20 starting from Take 158

If you choose not to upgrade, Check Point can supply a Hotfix. Contact Check Point Support to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect CPinfo files from the Security Management Server and Security Gateways involved in the case.

Hotfix installation instructions:

Refer to sk168597 - How to install a Hotfix.

• After applying the hotfix, confirm that emails from addresses listed in the IOC feed are blocked as expected.
• Check Threat Prevention logs to ensure blocks are recorded for IOC entries with Action: Prevent.

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

Article Properties

Access Level: General

Status: Approved by TAC

Date Created: 2025-09-21

Last Modified: 2026-07-23