topic Re: R81.20 and STIX File Imports (CISA) in Firewall & Security Management

R81.20 and STIX File Imports (CISA)

VikingsFan — Mon, 23 Sep 2024 20:53:29 GMT

Just starting to look into STIX files and getting our firewalls a little more smarter and importing feeds from outside sources. My first task is to try and get the CISA alert STIX files imported. I was hoping it was as easy as just importing the files but there looks to be specific CheckPoint values missing that is causing issues. When I import the file, everything is assigned to the 'Anti-Virus' product and I assume that's why when I was testing with my IP, nothing was being detected. I couldn't find a good example of how to get these categories set properly in my STIX file and/or if there was a way to easily massage the CISA (or other party) STIX files into a CheckPoint approved format?

For example, just playing with this latest notice and the STIX file attached: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a

Was following this doc and see that IP should be set to Anti-Bot but just not sure how: https://support.checkpoint.com/results/sk/sk132193

See attached on how it imports.

We're running R81.20 for management and the gateways in the cluster.

Re: R81.20 and STIX File Imports (CISA)

PhoneBoy — Mon, 23 Sep 2024 23:23:13 GMT

Looks like it's importing the file correctly.
Imported indicators will be enforced in Anti-Virus, so it's expected that will show.

Not clear what it is you are expecting to see here.

Re: R81.20 and STIX File Imports (CISA)

VikingsFan — Tue, 24 Sep 2024 11:12:38 GMT

Hi PhoneBoy,

When the observables were loaded and I tested against my IP accessing a web server in our DMZ, there were no detects on my IP which made me believe that it is not working properly. My theory was, after reading SK132193, the observables needed to be assigned the correct software blade. For an IP, according to the SK, it should be on the Anti-Bot and not the Anti-Virus, which is what it defaulted to.

Observable Type	Software Blade	Full Software Blade Name
URL	AV/AB	Anti-Virus / Anti-Bot
Domain	AV/AB	Anti-Virus / Anti-Bot
IP	AB	Anti-Bot
IP Range	AB	Anti-Bot
MD5	AV	Anti-Virus
Mail-subject	AV/AB	Anti-Virus / Anti-Bot
Mail-from	AV/AB	Anti-Virus / Anti-Bot
Mail-to	AV/AB	Anti-Virus / Anti-Bot
Mail-cc	AV/AB	Anti-Virus / Anti-Bot
Mail-reply-to	AV/AB	Anti-Virus / Anti-Bot
SHA1	AV	Anti-Virus
SHA256	AV	Anti-Virus
Snort	IPS	IPS

Re: R81.20 and STIX File Imports (CISA)

VikingsFan — Tue, 24 Sep 2024 11:28:12 GMT

I just did a CSV import with my IP and assigned it the Anti-Bot for the Product instead of the default Anti-Virus and I'm still not getting any detects when browsing to our web servers. Maybe it doesn't work as I think it would? Do the threat indicators detect/prevent inbound connections? I did confirm that my Bot and Virus profiles have the 'Enable Indicator Scanning' checked.

Re: R81.20 and STIX File Imports (CISA)

PhoneBoy — Wed, 25 Sep 2024 17:11:21 GMT

It's supposed to block inbound connections (as of R81), yes.
Recommend engaging with TAC here: https://help.checkpoint.com