topic Severity and Confidence Levels for Security Incidents in Endpoint

Severity and Confidence Levels for Security Incidents

MikeB — Thu, 24 Dec 2020 15:33:34 GMT

how severity and confidence levels are assigned to protections across all Sandblast Agent blades?? (AV / TE / Anti-Exploit / Behavioral Guard / Anti Ransomware / Port Protection / Firewall / App Control / Compliance).

I found some information in sk116254 but just regarding Network IPS /AV/AB.

Re: Severity and Confidence Levels for Security Incidents

PhoneBoy — Thu, 24 Dec 2020 18:59:08 GMT

We use similar criteria for all blades.
Firewall doesn’t use confidence/severity at all, neither does Port Protection.
App Control includes undesirable properties as part of the rating (e.g. file sharing, anonymizers, cloud-based password managers) which aren’t necessarily malicious.

Re: Severity and Confidence Levels for Security Incidents

MikeB — Thu, 24 Dec 2020 19:38:37 GMT

Thanks PhoneBoy.

Is there any SK for SBA with this official info available?? One of our SBA customers want to know details about the criteria used for incident classification that apperars in Forensic reports.

This is very important for them as they can plan their response to incidents.

Re: Severity and Confidence Levels for Security Incidents

PhoneBoy — Thu, 24 Dec 2020 21:27:13 GMT

Maybe @Lior_Arzi or someone on his team can clarify this.
Meanwhile if you have concerns about how a specific incident is rated, I recommend a TAC case.

Re: Severity and Confidence Levels for Security Incidents

RS_Daniel — Thu, 07 Jan 2021 13:44:03 GMT

Hello,

Does someone from Check Point has more information about how severity and confidence levels are assigned in SBA blades? It is a requirement from some customers to have this information.

Re: Severity and Confidence Levels for Security Incidents

PhoneBoy — Thu, 07 Jan 2021 16:52:28 GMT

Like I previously said, it's similar to what's in sk116254.
@Lior_Arzi do we have anything more specific to SBA?

Re: Severity and Confidence Levels for Security Incidents

Guy_Avnet — Sat, 09 Jan 2021 15:49:50 GMT

For SBA blades, we don't have a dedicated documentation besides the information in SK116254. That SK, as mentioned above, provides the general guidlines and SBA complies with these guildlines.

pls contact me directly if you need some specific information in that matter.

10x

Re: Severity and Confidence Levels for Security Incidents

MikeB — Tue, 12 Jan 2021 15:16:58 GMT

Hi @Guy_Avnet , I just send you a private message. Hope you can help us

Re: Severity and Confidence Levels for Security Incidents

PhoneBoy — Tue, 20 Jul 2021 16:06:07 GMT

I had sk116254 updated so it now lists Harmony Endpoint as one of the products it applies to.
Hopefully that will help those who are looking for “official” documentation.