topic Re: How to indicate new URL to Check Point in Firewall and Security Management

How to indicate new URL to Check Point

zsszlama — Thu, 27 Jul 2023 07:29:05 GMT

Hi,

Lately we have encountered that when our customer creates a new a URL that is blocked by gateway due to Protection Type: DNS Reputation. As a workaround we create an exception for it.

My question is how we can indicate this to Check Point modify the reputation of the new URL to safe? I'm aware of https://urlcat.checkpoint.com/urlcat/main.htm but it's for categorization and in most cases the category of the URLs are valid, so it's not a solution.

An SK about a new URL's life would be also useful what we could show to our customers.

Could you please these questions?

Thanks,

Zsolt

Re: How to indicate new URL to Check Point

_Val_ — Thu, 27 Jul 2023 07:31:57 GMT

As part of the process, DNS reputation checks how long a domain/URL exists. To avoid false positives, an exception is the best way, since you know in advance what that domain / URL would look like.

Re: How to indicate new URL to Check Point

G_W_Albrecht — Thu, 27 Jul 2023 07:47:48 GMT

URL reputation is estimated by several services / sites, and CP is also using that information sources. You will have to contact each of these that report the bad reputation.

But it can be the AV / AB blade that is reporting a certain URL as containing malware (look into log details) - in this case, TAC can help after opening a CP SR#.

Re: How to indicate new URL to Check Point

zsszlama — Thu, 27 Jul 2023 08:28:31 GMT

I thought that lifetime is the key indicator. Are you aware of any time limit for that even an SK what we could show to our customer?
(I don't want to advertise other vendors but I found such documents at the other big 2)

Re: How to indicate new URL to Check Point

PhoneBoy — Thu, 27 Jul 2023 12:51:36 GMT

URL Categorization (for Access Control) and Threat Prevention are handled differently.
You have the correct URL for reporting the correct category.
For false positives with respect to Threat Prevention, those need to be done through TAC: https://help.checkpoint.com

As for how the other “big two” handle this, you’re welcome to provide links to the relevant information since I’m not entirely clear what the actual question is here.

Re: How to indicate new URL to Check Point

zsszlama — Fri, 28 Jul 2023 06:12:42 GMT

URL categorization is valid according so that's why I was asking for guidance. Yeah, as a workaround we've created a threat prevention exception and raised a ticket.

Those are not great articles but at least something what I could share to a customer:

- https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPImCAO

- https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Newly-Observed-Domain-Webfilter-category/ta-p/250697

Re: How to indicate new URL to Check Point

PhoneBoy — Fri, 28 Jul 2023 17:33:14 GMT

I'm guessing the question is how we handle things we flag as "DNS Reputation."
Unfortunately, I haven't seen any documentation on this.
I do know that feedback is a part of the process, though.