topic Re: Does 61000 support custom Threat indicators in any version in Firewall and Security Management

Does 61000 support custom Threat indicators in any version

Varun_Arora — Sun, 02 Jul 2017 05:28:47 GMT

Threat Prevention has a option to add custom indicators from R77.20 and above. However, 61000 versions are R76SP.X. Does 61000 support the deployment of custom indicators in any version. We are running 61000 in R76SP.40 in VSX mode.

Re: Does 61000 support custom Threat indicators in any version

PhoneBoy — Mon, 03 Jul 2017 05:09:23 GMT

The next major release for the Scalable Platforms is expected to be based on R80 and thus should support this functionality.

Meanwhile, I would engage with your Check Point SE to discuss your specific requirements to see what can be done in the meantime.

Re: Does 61000 support custom Threat indicators in any version

Moti — Mon, 03 Jul 2017 05:11:51 GMT

Gera Dorfman , can't it be done maybe with a custom sig (snort ?) ?

Re: Does 61000 support custom Threat indicators in any version

Gera_Dorfman — Mon, 03 Jul 2017 08:29:10 GMT

As Dameon mentioned, we plan to align features set of Scalable Platform with R80.X.

Regarding the specific requirement, we need to understand which exact indicators are planned and see if meanwhile it can be achieved with SNORT.

Re: Does 61000 support custom Threat indicators in any version

Varun_Arora — Mon, 03 Jul 2017 09:00:57 GMT

Hi Gera, we are looking for simple IOC blocking with Md5 or IP Address for the prevention using Threat Indicators. Sample is shown below:

#UNIQ-NAME	VALUE	TYPE	CONFIDENCE	SEVERITY	PRODUCT
HOST107.181.174.34	107.181.174.34	IP		High	AB
HOST10.10.10.20	10.10.10.20	IP		High	AV
file1	23680e480e13981a4d96f7ed72f35c7f	MD5		Low	AV

Re: Does 61000 support custom Threat indicators in any version

PhoneBoy — Mon, 03 Jul 2017 17:21:53 GMT

You may able to leverage Private ThreatCloud to do the file hashes today, not 100% sure on IPs.

Either way, I recommend engaging your Check Point SE.

Re: Does 61000 support custom Threat indicators in any version

Gera_Dorfman — Mon, 03 Jul 2017 18:27:08 GMT

SNORT rules would be tricky and not optimal for such requirement.

Meanwhile you can use fast packet drop feature - note that the configuration is on the gateway and not on the management.

Check Fast Packet Drop feature in 61k Admin Guide

http://dl3.checkpoint.com/paid/71/71ae92768b018816ab82d91d3b361345/CP_R76SP.30_Security_System_AdministrationGuide.pdf?H…

In any case, please engage your Check Point SE.