topic Re: Automatic Adding of FBI/etc. Thread Indicators in Firewall & Security Management

Automatic Adding of FBI/etc. Thread Indicators

Dennis_Longneck — Tue, 12 Oct 2021 20:03:12 GMT

On a regular basis we get emailed a list of threat indicators from the FBI and other CIBER organizations. So when there are IP's or DNS names to block, we manually add them to our firewall rules.

I "thought" I saw somewhere there is a way to have automatic feeds to these and have the firewall updated automatically. Do I recall correctly? If so, is there any documentation on how to get this setup?

I have read this:

Configuring Threat Indicators (checkpoint.com)

But that is a manual process. I am lokoing for a somewhat automatic process as possible.

Thanks for any suggestions/pointers.

Dennis

Re: Automatic Adding of FBI/etc. Thread Indicators

PhoneBoy — Wed, 13 Oct 2021 02:14:47 GMT

That's one way to do it, ioc_feeds is another.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk132193&partition=Basic&product=Anti-Virus,

Re: Automatic Adding of FBI/etc. Thread Indicators

r1der — Wed, 27 Oct 2021 23:04:09 GMT

Do you know if there's any advantage or disadvantage from either using the .txt feeds (Provider has a domain.txt and IP.txt) or the STIX feeds?

Either choices seem like they can be automated with that ioc_feeds, but just wanted to double check since I have no experience in this.

Thanks!

Re: Automatic Adding of FBI/etc. Thread Indicators

PhoneBoy — Wed, 27 Oct 2021 23:40:05 GMT

Not as far as I remember.

Re: Automatic Adding of FBI/etc. Thread Indicators

Ruan_Kotze — Thu, 28 Oct 2021 06:54:31 GMT

Check Point's own InfinitySoC allows you to manage your own threat feed. IOC management is still in Early Access, but our testing has gone very well.

Re: Automatic Adding of FBI/etc. Thread Indicators

r1der — Fri, 29 Oct 2021 17:00:22 GMT

Did you get this setup Dennis? I plan to do the same with a feed from MS-ISAC. Curious to see whether STIX or the TXT files would be best ingested into CP. Thanks!

Re: Automatic Adding of FBI/etc. Thread Indicators

Dennis_Longneck — Fri, 29 Oct 2021 17:09:24 GMT

I did not get it setup. Didn't see a way to automatically have it done....even with the MS-ISAC ones. 😞

Re: Automatic Adding of FBI/etc. Thread Indicators

HristoGrigorov — Sat, 30 Oct 2021 04:12:28 GMT

From what I know IOC Feeds are only blocking outgoing connections and not incoming ones. Which is sometimes not what you want...

Re: Automatic Adding of FBI/etc. Thread Indicators

PhoneBoy — Sat, 30 Oct 2021 05:22:35 GMT

In R81 it also blocks outgoing connections.
Even in pre-R81, while the outgoing connection is not blocked, the reply traffic from those IPs will be blocked.

Re: Automatic Adding of FBI/etc. Thread Indicators

genisis__ — Sat, 30 Oct 2021 11:04:45 GMT

When using feeds, are the blocks shown in the logs? Additionally if we are asked to blacklist an IP, how can we easily confirm this is already taken care of?

Are there any performance overheads?

Re: Automatic Adding of FBI/etc. Thread Indicators

Alex- — Sat, 30 Oct 2021 14:07:19 GMT

Yes, because the feeds are added in AV/AB blades so you see them in TP logs. I didn't see any specific overheads by using the feature.

Re: Automatic Adding of FBI/etc. Thread Indicators

genisis__ — Sat, 30 Oct 2021 21:34:49 GMT

nice, when I was talking about overhead, I assume the gateway itself pulls the feed therefore connectivity would go via slowpath, interestingly if this was a VSX setup, is the tool aware of VSs? Similar to log_exporter?

Re: Automatic Adding of FBI/etc. Thread Indicators

skidsteerpilot — Thu, 04 Nov 2021 13:22:23 GMT

We are running R80.40 and I have recently setup ioc_feeds with the MS-ISAC Taxii/Stix feeds. My lack of familiarity with Stix/Taxii/ioc_feeds probably quadrupled the time spent, but the short story is I had to use python/cabby (https://github.com/eclecticiq/cabby) and script a process to pull the feeds and parse out domain/url/ip data into a csv file for ioc_feeds to pull in. What I discovered was that Checkpoint will ingest a single Stix Package in txt format, but will not ingest a feed/file that consists of multiple Stix Packages rolled up into a single document, which is what I ended up with. I probably could have tinkered with the xml tags to see if I could get the CP to ingest, but not knowing what the CP was looking for, decided to stick with what I could easily decipher in the docs (csv). We comment each ioc with the associated feed so we can see it in the logs. This is not elegant, but it is functional. If there's a better way I'd be all ears....

Re: Automatic Adding of FBI/etc. Thread Indicators

asafav — Sun, 28 Nov 2021 07:51:54 GMT

The feed is being pulled with “slow path” Infrastructure but the enforcement itself is running with fastpath.

IOC feeds infra isn’t aware to the VSX gateways and behave for each one as a separated one.

Re: Automatic Adding of FBI/etc. Thread Indicators

Nir_Naaman — Mon, 29 Nov 2021 09:32:39 GMT

Check Point NDR Smart Intel is a Generally Available solution that automates indicator input feed ingestion and distribution to Check Point and 3rd party gateways. It is also the basis for Infinity Vision SOC's IOC Management facility.

Customers who purchase Infinity SOC are automatically entitled to use NDR applications.

Check out https://community.checkpoint.com/t5/CloudGuard-NDR/NDR-Smart-Intel-User-Guide/m-p/131434 for details.

Re: Automatic Adding of FBI/etc. Thread Indicators

Benjamin_Weiss — Wed, 14 Dec 2022 13:34:29 GMT

Sorry, I'm just getting into the STIX space. I was emailed one from the FBI, but it was in STIX 2.0 format. I manually imported it into the Threat Tools->Indicators, but got a bunch of warnings. I then did a quick google, which showed Checkpoint keeps saying that they only support 1.0. Is Checkpoint ever going to upgrade to the current standard (which is actually 2.1)?

Re: Automatic Adding of FBI/etc. Thread Indicators

PhoneBoy — Wed, 14 Dec 2022 19:13:15 GMT

An RFE with the local Check Point office is recommended here.

Re: Automatic Adding of FBI/etc. Thread Indicators

Nir_Naaman — Mon, 23 Jan 2023 18:06:04 GMT

Horizon NDR Intel now supports STIX/TAXII v2.* for both automated input feeds and Load from file.