topic How to apply both Check Point's and our own intelligence to the traffic logs from Smart-1 Cloud in Cloud Firewall

How to apply both Check Point's and our own intelligence to the traffic logs from Smart-1 Cloud

TSOL — Thu, 17 Oct 2024 10:58:16 GMT

Hello Team,

We have our own extensive blacklist, and we want to analyze traffic logs using both Check Point's threat intelligence and our own blacklist.

In Smart-1 Cloud, is it possible to reference not only Check Point’s intelligence but also our company’s blacklist?

if you have any idea, please let me know.

Re: How to apply both Check Point's and our own intelligence to the traffic logs from Smart-1 Cloud

Ruan_Kotze — Thu, 17 Oct 2024 11:53:51 GMT

One way of accomplishing that would be to consume your company's block list in the form of a Threat Feed. That should make it fairly easy to analyze and at the same time prevent access to / from block listed entities.

Re: How to apply both Check Point's and our own intelligence to the traffic logs from Smart-1 Cloud

PhoneBoy — Thu, 17 Oct 2024 15:50:25 GMT

You have a couple of options, both of which work with Smart-1 Cloud:

Custom Threat Feeds (requires Anti-Virus to be enabled)
Network Feeds (requires R81.20), which can be referenced directly in the Access Policy