topic Re: Automating IPS in Firewall and Security Management

Automating IPS

Mike_Painter — Tue, 29 Aug 2017 12:39:19 GMT

In short, it would be great if Check Point could interface with a vulnerability scanner to automatically configure IPS rules based off various parameters. Wishful thinking, perhaps?

For example, lets say anything with a CVSS of 1-4 is inactive, 5-7 is in detect, and 8-10 is protect. You could then run this against the Confidence and Performance Impact of the IPS rules. Say something is a CVSS of 9, Confidence of IPS rule is Low and Performance High, perhaps it will only be in detect mode and only apply to those machines that are vulnerable. Then, if you choose to override it yourself, you can. Over time, as updates are applied, IPS gets trimmed back automatically, and as new vulnerabilities are discovered, IPS also keeps up. This would take things to that next level of enabling JUST what you need automatically.

Are there any products out there that do this, or has anyone tinkered with the API for this?

Re: Automating IPS

Tomer_Sole — Tue, 29 Aug 2017 12:49:33 GMT

R80 and R80.10 provide IPS Tags for this behavior. Read more here: How does R80 assist in saving time handling activation of IPS protections?

Re: Automating IPS

Mike_Painter — Tue, 29 Aug 2017 15:34:50 GMT

Not sure how I overlooked that, but this is helpful. I guess now the missing piece is tying this back to a vulnerability scanner, or somehow leveraging the API.

Re: Automating IPS

Bobby_Brill — Wed, 30 Aug 2017 02:02:38 GMT

Have you looked at any orchestration tools such as Phantom? We use this for other similar use cases.

Good luck,

Bobby

Re: Automating IPS

Mike_Painter — Thu, 07 Sep 2017 19:07:31 GMT

I'd like to point out there are roughly 1700 tags, but I receive an error when adding more than 32. So if you chose to automatically disable CVSS score of 1.0 - 2.9, that is 20 of the 32 available used up.

Re: Automating IPS

Mike_Painter — Thu, 07 Sep 2017 19:08:09 GMT

This is something I have been wanting to look into. Thank you!

Re: Automating IPS

VCL001 — Mon, 04 Dec 2017 23:05:43 GMT

Tomer, is there an update to this thread post Mike's finding of the 32-tag limitation?

Re: Automating IPS

Manuel_Kuback — Fri, 28 Sep 2018 07:25:37 GMT

Tomer Sole‌ is there an update to the 32-tag limitation? Because this one still exists today!

Re: Automating IPS

Mike_Painter — Tue, 12 Feb 2019 16:19:01 GMT

From CPX, if you are on R80.20M2 or R80.30, they now offer something called Smart Threat Profile. It will monitor your traffic and select the IPS that it thinks you need. You can then compare it to your existing policy to choose if you want to use it moving forward. I don't think it's GA yet but you can reach out to threat_smart_profile@checkpoint.com.

Re: Automating IPS

Manuel_Kuback — Fri, 15 Feb 2019 08:09:38 GMT

Sounds interesting. I just reached out to the mail you provided. Let's see 🙂

I will also attend the CPX in Vienna. Looking forward to it!

Re: Automating IPS

PhoneBoy — Fri, 15 Feb 2019 23:49:59 GMT

I believe we'll have a demo of it in the Technology Innovation area.

Re: Automating IPS

Omer_Shliva — Sat, 16 Feb 2019 12:03:46 GMT

We'll be there.

Re: Automating IPS

Peter_Baumann — Thu, 17 Oct 2019 09:12:09 GMT

Hi all,

I tested the limitation of 32 tags in IPS with R80.20 and R80.30 and it is still the same.

I also could not find any informations about "Smart Threat Profile" in R80.30. So I also asked now in the E-Mail threat_smart_profile@checkpoint.com for more information about it.

When I get updates I will post it here...