Cato Networks

This skill covers Cato Networks' single-vendor SASE cloud platform. Cato differentiates itself by building SD-WAN and the complete security service edge into one cloud-native platform from inception — not assembled through acquisitions. All traffic flows through Cato's single-pass cloud engine across 80+ global PoPs.

How to Approach Tasks

When you receive a request:

Classify the request:
- SD-WAN — Cato Socket, site connectivity, last-mile optimization, HA
- SWG/Internet security — URL filtering, TLS inspection, threat prevention
- CASB/DLP — SaaS visibility, inline control, data protection
- ZTNA — Private application access, Cato Client, Zero Trust policies
- FWaaS — Network firewall policies, IPS, anti-malware
- XDR — Cato XDR, threat hunting, incident response
- Architecture — PoP design, single-pass processing, deployment models
Identify the deployment scope — Sites (offices with Cato Sockets), mobile users (Cato Client), or cloud connectors (AWS/Azure VPCs).
Recommend — Provide Cato-specific guidance with Cato Management Application (CMA) navigation paths.

Cato SASE Architecture

Single-Vendor SASE Philosophy

Cato Networks was founded (2015) with the explicit goal of building SASE as a unified platform — before the term "SASE" was coined by Gartner. Unlike competitors who assembled SASE by acquiring separate SWG, CASB, and SD-WAN companies, Cato built everything natively:

Native integration benefits:

Single data model: One policy engine, one log schema, one management console
Single agent: Cato Client handles ZTNA + internet security + SD-WAN optimization
Single support: No finger-pointing between vendors for cross-component issues
Single analytics: All traffic visible in one console, correlated automatically

Cato Cloud Architecture

Cato SASE Cloud
├── Global PoP Network (80+ PoPs)
│   ├── Single-pass processing engine
│   ├── SD-WAN: WAN optimization, active-active HA
│   ├── NGFW / FWaaS: L4-L7 policy
│   ├── SWG: URL filtering, TLS inspection
│   ├── CASB: Inline + API SaaS security
│   ├── DLP: Data loss prevention
│   ├── IPS: Intrusion prevention
│   ├── Anti-malware: Multi-layer (signatures + behavioral + ML)
│   ├── DNS Security: Malicious domain blocking
│   ├── ZTNA: Private app access
│   └── RBI: Remote Browser Isolation (add-on)
│
├── Cato Management Application (CMA)
│   ├── Single console for all sites, users, policies
│   ├── Built-in analytics and reporting
│   └── Cato XDR (extended detection and response)
│
└── Cato CTRL (Threat Research)
    ├── Threat intelligence updates to all PoPs
    └── Threat hunting across customer telemetry

Single-Pass Processing Engine

All traffic at every Cato PoP passes through a single processing pipeline — one TLS decrypt, all inspection engines run simultaneously.

Traffic arrives at Cato PoP
        ↓
Connection classification
(Is this SD-WAN site traffic, mobile user, or cloud resource?)
        ↓
TLS termination (single decrypt)
        ↓
┌────────────────────────────────────────────────────────┐
│                  Parallel Inspection                   │
│  App/Protocol    URL Category    IPS Signatures        │
│  Identification  DNS Security    Anti-malware          │
│  CASB Activity   DLP Content     Behavioral ML         │
└────────────────────────────────────────────────────────┘
        ↓
Policy decision (NGFW rule evaluation)
        ↓
Action + logging
        ↓
TLS re-encrypt + forwarding

SD-WAN with Cato Socket

Cato Socket

The Cato Socket is a hardware or virtual SD-WAN device deployed at office/branch locations.

Socket models:

X1500: Small offices (up to 100 Mbps)
X1600: Medium offices (up to 500 Mbps)
X1700: Large sites (up to 1 Gbps)
X1700 (HA): Hardware HA pair for high-availability deployments
vSocket: Virtual appliance for VMware, Hyper-V, AWS, Azure, GCP

Socket connectivity:

2 WAN interfaces (broadband, MPLS, LTE)
1+ LAN interfaces
Management interface (out-of-band)

Last-Mile Optimization

Cato Socket provides active-active dual WAN with intelligent path selection:

Active-active bonding: Traffic distributed across both ISP links simultaneously (not just failover):

Improves throughput for bulk transfers
Reduces impact of single-ISP packet loss
Seamless failover when one link degrades

Path quality scoring: Cato scores each WAN link continuously:

Latency to nearest Cato PoP
Jitter
Packet loss
Availability (ICMP probes + TCP probes)

Application-aware steering:

VoIP (RTP/SIP): Route via lowest-jitter path
Video (Zoom): Route via lowest-latency path
Bulk backup: Route via highest-bandwidth path
Default: Load-balance across both links

Link failure detection: Sub-second detection of link failures via continuous probes. Failover < 1 second with active-active bonding (vs. BGP convergence of 30-90 seconds with traditional router failover).

Cloud On-Ramp

For AWS/Azure/GCP: Deploy a vSocket in the cloud VPC/VNet:

Launch vSocket from marketplace (AWS AMI, Azure Marketplace)
Configure with Cato account credentials
vSocket connects to nearest Cato PoP
Route private subnets through vSocket

Benefit: All traffic from cloud workloads to the internet passes through Cato's security stack. No need for a separate cloud firewall or security appliance.

ZTNA on Cato

Private Application Access

Cato SDP (Software-Defined Perimeter) for ZTNA: Users with Cato Client access private applications through Cato's cloud — applications never exposed to the internet.

Configuration:

Define "IPSec Connections" or "Cloud Connectors" for app hosting location connectivity (already done if using vSocket)
Define application in Cato Management Application
Create access policy: User group → Application → Action: Allow

ZTNA policy granularity:

Policy: Finance Team → SAP
Source User: Group = "Finance" 
Source Device: Posture = "Compliant"
Destination App: SAP-Production (defined by IP/FQDN)
Service: TCP 443, TCP 8443
Action: Allow

Policy: Contractors → Limited Apps
Source User: Group = "Contractors"
Destination App: Contractor-Portal
Action: Allow

Device posture for ZTNA: Cato Client reports device posture. Access policies can require:

OS version
Disk encryption
Antivirus (specific vendor + update recency)
EDR agent running

Cato Client

Supported platforms: Windows, macOS, Linux, iOS, Android.

Function: Single agent for both ZTNA (private app access) and internet security (SWG via Cato cloud). No separate VPN client needed.

Connection establishment: Cato Client connects to nearest Cato PoP. All corporate internet traffic + private app access flows through this connection.

Always-on mode: Cato Client can be configured always-on — device always connected to Cato SASE cloud. No user action required.

FWaaS and Security Policies

Firewall Policy Structure

Cato's firewall policy is a unified North-South + East-West rule set.

Traffic directions:

WAN → Internet: Outbound internet traffic from sites/users
WAN → WAN: Site-to-site traffic (between offices, or office to cloud)
Internet → WAN: Inbound to DMZ/published services
ZTNA access: User → Private Application

Rule structure:

Rule: Block Outbound Malware Categories
Source: Any (site or user)
Destination: URL Category = Malware, Phishing, Botnet
Action: Block

Rule: Allow M365
Source: Any
Destination: App = Microsoft 365 (App-ID)
Action: Allow + Inspect

Rule: Allow Finance to SAP (WAN to WAN)
Source: Site = HQ-Finance-VLAN (IP range 10.10.20.0/24)
Destination: IP = SAP-server (10.50.0.10)
Service: TCP 443, TCP 8443
Action: Allow

IPS (Intrusion Prevention System)

Cato IPS uses a combination of signature-based and behavioral detection.

IPS policy:

Severity levels: Critical, High, Medium, Low, Informational
Actions per severity: Block / Alert / Allow
Recommended baseline: Block Critical + High; Alert Medium

IPS update mechanism: Cato CTRL (threat research team) pushes IPS signature updates to all PoPs continuously. No customer-side action required.

Custom IPS rules: Enterprise customers can add custom Snort-compatible signatures.

Anti-Malware

Multi-layer anti-malware:

Signature-based (AV): Known malware detection
ML-based behavioral: Detect novel malware by behavior patterns
Threat intelligence: Block known-malicious hashes (Cato CTRL + external feeds)
Sandboxing (premium): Full detonation for unknown files

Anti-malware policy:

Enable for: Downloads from internet, uploads to SaaS (if inline CASB enabled)
Malicious verdict action: Block
Unknown/suspicious verdict action: Alert + allow (or hold + sandbox)
File type scope: Executables, Office documents, PDF, Archives

CASB and DLP

Inline CASB

Cato's inline CASB provides application-level visibility and control for SaaS traffic flowing through the platform.

Shadow IT discovery: All SaaS app usage visible in CMA → Monitoring → Cloud Apps:

App name, risk category, usage volume
User/site breakdown
CCI (Cloud Confidence Index) equivalent score

Application controls:

Policy: Restrict personal cloud storage
Application: Google Drive Personal, Dropbox Personal, OneDrive Personal
Activity: Upload
Action: Block

Policy: Allow corporate storage
Application: Google Drive Corporate, OneDrive Corporate, Box Corporate
Activity: All
Action: Allow + DLP Inspect

DLP

Cato DLP provides content inspection for sensitive data.

Detection methods:

Pattern-based: Credit cards, SSN, IBAN, health data patterns
Custom patterns: Organization-specific regex
Keyword dictionaries: Custom sensitive word lists

DLP policy:

Profile: Confidential-Data
  Rules:
  - Credit Card Numbers (Luhn validated), count >= 3
  - Social Security Numbers, count >= 5
  - Custom: "Project-Confidential" keyword

Policy: Block Confidential Upload to Personal Storage
  DLP Profile: Confidential-Data
  Destination: Cloud Storage (Personal)
  Action: Block + Alert

Cato XDR

Threat Detection and Response

Cato XDR is built into the CMA console — no separate SIEM required for many use cases.

Data sources for XDR:

All network flows (Cato processes 100% of traffic, full visibility)
Security events (IPS alerts, malware detections, policy blocks)
Identity signals (if IdP integrated)
Endpoint signals (if Cato Client telemetry enabled)

Threat stories: Cato XDR correlates individual events into "Threat Stories" — a timeline of related events suggesting an attack sequence.

Example Threat Story:

1. Suspicious DNS query to newly registered domain (14:02 UTC)
2. HTTP request to malicious URL from same user (14:03 UTC)
3. File download detected as potentially malicious (14:03 UTC)
4. Post-infection C2 callback detected (14:05 UTC)
→ XDR correlates: "Possible malware infection — User X, Device Y"
   Score: Critical
   Recommended action: Isolate device

Investigation tools:

Story timeline: All events in chronological order
Entity graph: Visual relationship map (user ↔ device ↔ destination ↔ file)
Raw event search: Query all events with filters

SOAR integration: Cato XDR can trigger webhooks to SOAR platforms (Palo Alto XSOAR, Splunk SOAR):

Ticket creation in ServiceNow
Automated device isolation
Alert to SOC team

Cato CTRL (Threat Research)

Cato CTRL is Cato's threat research team. Functions:

Threat intelligence aggregation from open and commercial sources
Original research on novel attack techniques
CVE response and IPS signature development
Threat hunting across Cato's global customer base (anonymized)
Research publications: CTRL Cyber Threats Reports, vulnerability disclosures

Intelligence delivery: Cato CTRL updates are pushed to all 80+ PoPs continuously. No customer action required for new IOCs or IPS signatures.

Management and Reporting

Cato Management Application (CMA)

Single console at cc.catonetworks.com.

Key sections:

Network → Sites: Cato Socket status, connectivity, WAN link health
Security → Policy: FWaaS, NGFW rules
Security → Cloud Apps: CASB shadow IT and policy
Security → DLP: DLP profiles and policies
Monitoring → Dashboard: Real-time traffic and security overview
Monitoring → Events: Security event stream
XDR → Stories: Threat stories and investigations
Reports → Executive: CISO-level summary reporting

SIEM Integration

Log export: Cato supports syslog (CEF format) and REST API for log export.

SIEM integrations:

Splunk: Cato App for Splunk (Splunkbase)
Microsoft Sentinel: Cato connector
Generic CEF syslog: Any SIEM that accepts CEF

API:

# Cato REST API (v1)
curl -H "x-api-key: {api_key}" \
     "https://api.catonetworks.com/api/v1/account/{account_id}/events"

Site Provisioning

Zero-touch provisioning: Cato Sockets ship pre-provisioned. Plug in at branch, power on — Socket phones home to Cato cloud, downloads configuration, and is operational within minutes. No IT staff needed on-site.

Provisioning process:

Admin creates new site in CMA (name, timezone, WAN IP configuration)
CMA generates a provisioning token
Ship Socket to branch (with printed token)
Branch plugs in Socket; Socket connects to Cato cloud, downloads full config
Site is live — admin sees it turn green in CMA

Configuration push: All config changes in CMA are pushed to the Socket within seconds. No CLI access to individual Sockets needed for routine operations.

cato

SKILL.mdplugins/security/skills/cato/SKILL.md