topic Re: Sweep Scan preventing in Firewall and Security Management

Sweep Scan preventing

Elias — Thu, 16 Nov 2023 18:23:04 GMT

Hello, I have a question, currently we se sweep scan logs, we have already configured the Host port Scan but it appears in Detect mode, it there a way to verify that it is actually blocking or is it normal that the logs show it in Detect mode and not Prevent mode ?

Re: Sweep Scan preventing

JoSec — Thu, 16 Nov 2023 20:05:50 GMT

The URL below, indicates the signature will only alert to the activity but not block. You can utilize Smartevent which will use SAM rules to block an IP address for configurable amount of time for IP Sweeps, port scans and other detections.

https://sc1.checkpoint.com/documents/R80.30/SmartConsole_OLH/EN/html_frameset.htm?topic=documents/R80.30/SmartConsole_OLH/EN/jj4esSF9GWk3-Am1vs1tNQ2

Re: Sweep Scan preventing

the_rock — Thu, 16 Nov 2023 20:48:47 GMT

Makes sense, as it does not give option to block it from IPS protection itself in smart console.

Andy

Re: Sweep Scan preventing

Elias — Wed, 22 Nov 2023 14:59:35 GMT

So what can I do to block this type of scanning ??

Re: Sweep Scan preventing

the_rock — Wed, 22 Nov 2023 15:03:40 GMT

Maybe better to open TAC support case to get an official answer.

Regards,

Andy

Re: Sweep Scan preventing

JoSec — Wed, 22 Nov 2023 15:14:56 GMT

If you have Smartevent, utilizing a response for external IP Sweeps to block the source IP address for a time you determine works great. I would advise the first time you do enable the feature in Smartevent, enable a response with an email to you so you can see the volume and make sure you would not block legitimate sources. Using Playblocks, in the portal.checkpoint.com, they have some automations for blocking that maybe what you are looking for if you do not have Smartevent. Obviously, you would need a license for Smartevent or Playblocks.

Re: Sweep Scan preventing

Tal_Paz-Fridman — Wed, 22 Nov 2023 21:00:12 GMT

We are examining how to add this as a new automation to Horizon Playblocks.

It already includes automations to block attacks and scans such as:

Block common scanner identified by IPS

The automation blocks scanners across the organization and is triggered by scans that are detected by IPS with very high confidence. The block can be automatic, or upon admin's approval. The notification includes information on the scan and the scanner. More parameters can be set using the automation parameters such as the block duration, whether the block is automatic or upon admins' approval, and more.

https://www.checkpoint.com/horizon/playblocks/