topic Cyber Attack Views in SmartEvent in Firewall and Security Management

Cyber Attack Views in SmartEvent

Danny — Thu, 06 Sep 2018 08:51:37 GMT

Check Point finally released the R80.10 GA version of his

Cyber Attack View Addon for SmartEvent (sk134634).

The Beta-Version was also shared with and tested by the CheckMates community in this blog entry from April 2018.

The additional view, now made available, helps you to better understand how to investigate threat prevention attacks in your organization. Usualy, One of the major tasks of a threat hunter is to find the needle in the haystack inside a big amount of event Check Point technologies create for him. In most cases, the admin is the one who responsible also to query the events we create for him and understand the threat landscape of his organization. The Cyber Attach View is focusing on an automatic threat analysis using SmartView/SmartEvent.

How to import the cyber-attack view into SmartEvent?

R80.10 GA does not include the cyber-attack view, thus it's required to import it into SmartEvent. Follow these steps to import and generate the latest views:

Download the cyber-attack view from this link.
Extract the cpr file into a directory.
Open SmartView Monitor or SmartConsole (Logs & Monitors) > In the left tree, click on Views.
On the toolbar, click on Actions > Click on Import Template > Select the new template file (Cyber_Attack_View.cpr) and import the template (*.cpr).
The new template should appear in the list.
Double-click the template to generate the view.

Re: Cyber Attack Views in SmartEvent

_Val_ — Thu, 06 Sep 2018 08:54:45 GMT

Very useful, thanks, Danny Jung‌

Re: Cyber Attack Views in SmartEvent

jose_monge — Tue, 26 Jul 2022 22:59:57 GMT

good, report.

Re: Cyber Attack Views in SmartEvent

Matlu — Mon, 09 Jun 2025 23:35:34 GMT

Hi, @Danny
I would like to be able to use this report template.
How can I get the template to run it in my environment?
I have 2 MDS boxes, with multiple CMA.
Is it possible to get this report template, please?
Thank you.

Re: Cyber Attack Views in SmartEvent

Amir_Senn — Tue, 10 Jun 2025 07:55:59 GMT

Integrated into new version + updated link:

https://support.checkpoint.com/results/sk/sk134634

Re: Cyber Attack Views in SmartEvent

Matlu — Tue, 10 Jun 2025 12:26:10 GMT

Hello, @Amir_Senn
In an MDS environment, this is 'loaded' in the 'Logs&Monitor' section of the main (MDS) box and replicated in all the CMA's I have?
Or does it have to be loaded, one by one, in each CMA?
I have a lot of CMAs and I am wondering how to load it.
Thanks

Re: Cyber Attack Views in SmartEvent

Amir_Senn — Tue, 10 Jun 2025 14:32:52 GMT

You can upload to MDS and use share and it would should be uploaded to CMAs as well.

But you should have it already:

Re: Cyber Attack Views in SmartEvent

Matlu — Tue, 10 Jun 2025 14:39:40 GMT

An inquiry
These custom reports help me with the 'Threat Prevention' part, right?
Basically my need is to 'see' what is related to attacks, where blades such as IPS, AV, AB intervene, since my client has been exposed to attacks and information leakage to the Internet.
Do these custom reports help me?

Re: Cyber Attack Views in SmartEvent

Amir_Senn — Tue, 10 Jun 2025 15:15:56 GMT

Will help you with anything detected/prevented by the Threat Prevention blades.

If you have security issues related to Access Control it will not help with that.

For best practices that will help you avoid such vulnerabilities you might want to check Compliance blade as well.