Real-Time Protection is the Versa Security Service Edge (SSE) policy category that inspects and enforces security controls – URL filtering, malware protection, intrusion prevention (IPS), CASB, and data loss prevention (DLP) – on live traffic. Administrators configure it in Concerto as Internet Protection rules for internet-bound traffic and Private Application Protection rules for traffic to private enterprise applications.
Key takeaways
- Real-Time Protection is Versa’s SSE policy category for live traffic inspection.
- Internet Protection rules cover internet-bound traffic on the Secure Web Gateway.
- Private App Protection rules cover custom apps reached over the enterprise VPN.
- Security profiles attach malware, IPS, CASB, DLP, and URL controls to rules.
- Rules only take effect after the configuration is published from Concerto.
On this page: Why it mattersHow it worksTypesReal-Time Protection & VersaFAQ
Why is Real-Time Protection important?
Traffic doesn’t stay still long enough for a security team to review it by hand – a session either gets inspected and enforced against policy the instant it happens, or it doesn’t get inspected at all. Real-Time Protection is the layer that does that inline work: it evaluates every internet-bound and private-application session against match criteria – applications, users, geolocation, network – and applies enforcement, from a simple allow or deny to a full stack of security profiles, before the traffic reaches its destination.
It’s also where most of a SASE deployment’s actual security posture lives. URL filtering, malware scanning, intrusion prevention, CASB controls for cloud apps, and DLP for sensitive data all attach to Real-Time Protection rules rather than existing as separate standalone controls, so a single rule can, for example, allow access to a SaaS application while still scanning uploads for malware and blocking documents that match a DLP data pattern. Getting these rules right is what turns a SASE architecture from network connectivity into an actual security boundary.
What is Real-Time Protection?
In Concerto, Real-Time Protection sits under Security Service Edge and groups two kinds of firewall rules with the security profiles that enforce policy on the traffic they match. Each rule combines match criteria – applications (individual, grouped, or by category), users and groups, source geolocation and IP address, Layer 3/4 network criteria, and optionally endpoint posture – with a security enforcement action: Allow, Deny, or Reject, optionally backed by a full stack of security profiles.
Rules are configured per tenant, and the first rule of each type walks the administrator through a guided wizard; subsequent rules are built directly on the Internet Protection or Private Application Protection screens. None of it takes effect on the gateway until the configuration is published from Concerto – a rule can be fully built and saved without yet protecting any traffic.
Types of Real-Time Protection
Two rule types split enforcement by where the traffic is going. Internet Protection rules apply on the Versa Secure Web Gateway to internet-bound traffic, matching against predefined applications, URL categories, and URL reputations as well as users and network criteria. Private Application Protection rules apply on the Versa Gateway to traffic destined for custom applications reached over the enterprise VPN; they cannot match predefined or grouped applications – only the private applications an administrator has explicitly defined.
Both rule types draw enforcement from the same security profiles, configured once under Real-Time Protection > Profiles and referenced by any matching rule: Malware Protection and IPS profiles for threat scanning, CASB profiles for cloud-application controls and risk-based actions, and DLP profiles – built from data patterns, data protection profiles, and DLP rules – for detecting and acting on sensitive content in uploads, downloads, and message bodies.
Real-Time Protection & Versa
Concerto’s SASE configuration workflow treats Real-Time Protection as one of the final steps after secure access, applications, and TLS decryption are in place – TLS decryption in particular has to be configured first for CASB and DLP profiles to inspect encrypted payloads at all. A representative deployment walk-through in the VSPA step-by-step configuration guide builds a Private Application Protection rule that matches VIP users against financial and HR applications and enforces predefined Malware Protection and IPS profiles, with Endpoint Posture, geolocation, and Layer 3/4 criteria left at their defaults.
DLP is the most involved profile type to configure: the DLP configuration guide walks through building a data pattern, a Data Protection profile, a DLP rule with a severity level and trigger action, and a DLP profile that ties them to specific cloud applications – then attaching that DLP profile to an Internet Protection rule as the last step. Every rule, regardless of profile mix, only takes effect after the tenant’s configuration is published from Concerto to the gateway.
Frequently asked questions
What is the difference between Internet Protection and Private Application Protection rules?
Internet Protection rules apply on the Secure Web Gateway to general internet-bound traffic and can match predefined applications, URL categories, and reputations. Private Application Protection rules apply on the Versa Gateway to traffic reaching custom applications over the enterprise VPN, and can match only administrator-defined private applications.
What security profiles can a Real-Time Protection rule enforce?
A rule’s security enforcement can include Malware Protection and IPS profiles for threat scanning, CASB profiles for cloud-application risk controls, and DLP profiles for detecting sensitive data. Profiles are configured once under Real-Time Protection > Profiles and referenced by any Internet Protection or Private Application Protection rule.
Does a Real-Time Protection rule take effect as soon as it’s saved?
No. Saving a rule stores the configuration in Concerto, but the Versa Gateway or Secure Web Gateway only applies it after the tenant’s configuration is published. An administrator can build and review a rule without any risk of it affecting live traffic until publish.
Why does DLP require TLS decryption to be configured first?
DLP profiles inspect the actual content of uploads, downloads, and message bodies to match data patterns. Most of that traffic is encrypted, so without a TLS decryption rule for the relevant applications, the payload stays opaque and DLP has nothing to scan.
Can Private Application Protection rules match predefined applications?
No. Private Application Protection is scoped to custom applications an administrator defines explicitly – it cannot match predefined applications or predefined application groups the way Internet Protection rules can. Any app referenced in a private-protection rule must first be created as a private application.
More on Real-Time Protection
If you want to learn more, these are sources we trust.
| Versa Networks: products | Versa Networks: secure SD-WAN | Versa Academy |
|---|---|---|
| The vendor’s product pages, including the Security Service Edge and SASE offerings that Real-Time Protection policies run on. | The SD-WAN and SASE fabric that carries the internet-bound and private-application traffic Real-Time Protection inspects. | Training and labs that build Internet Protection, Private Application Protection, and DLP rules hands-on in Concerto. |
Related terms
If you’re reading about Real-Time Protection, these are worth looking at next.
| Malware | URL Filtering | Versa SASE Portal |
|---|---|---|
| The threat class Malware Protection profiles scan for and block when attached to an Internet or Private App Protection rule. | The category- and reputation-based control Internet Protection rules apply to internet-bound traffic as one security profile among several. | A second surface for real-time protection rules – client-to-cloud VSA and SWG deployments – whose configuration screens Concerto can front. |