topic Re: Tools / Methods to Test SBA? in Endpoint

Tools / Methods to Test SBA?

David_Levine — Fri, 23 Mar 2018 17:59:00 GMT

Hi All,

I am deploying SBA to all of our endpoints, but was curious to run some tests against it as I go. I recently downloaded and tried to run a tool called RanSim from the folks over at KnowBe4; The tool is supposed to simulate behaviors of various ransomware variants. When using this tool to execute its tests, SBA knocked it down as expected, generated an analysis, etc. etc... (before the tool could even run its tests )

I thought this was a neat little test and was wondering if anyone does something like this on occasion, and what tools / methods do you use?

Thanks!

David

Re: Tools / Methods to Test SBA?

PhoneBoy — Fri, 21 Jun 2019 09:00:11 GMT

Let me move this to the https://community.checkpoint.com/community/threat-prevention/sandblast-agent-endpoint?sr=search&searchId=0f122543-7c34-4eff-addd-cf2fae9d1c39&searchIndex=0‌ specific space

Re: Tools / Methods to Test SBA?

Kim_Moberg — Sat, 24 Mar 2018 10:41:06 GMT

Dameon,

Could it be an idea to make a similar non harmfull tool on check point wiki, were one can test both antibot and antivirus blade?

Kim

Re: Tools / Methods to Test SBA?

PhoneBoy — Sat, 24 Mar 2018 20:23:30 GMT

We do have test URLs already that serve non-harmful content for AV, Anti-Bot, and Threat Emulation.

You can find them on Threatwiki.checkpoint.com on the upper right hand corner of the page

Re: Tools / Methods to Test SBA?

Kim_Moberg — Sat, 24 Mar 2018 20:28:37 GMT

Yes. Thats the one I was thinking of. But do you have similar url that simulate ransomware and crypto mining without harming the Customers machine?

Re: Tools / Methods to Test SBA?

David_Levine — Sat, 24 Mar 2018 20:41:16 GMT

Thanks Dameon! I will certainly check that out... I knew that there was an eicar file that could be downloaded from the Check Point site to test AV, but testing Anti-Bot at the gateway would be awesome also. However, we don't have TE at the gateway, only with endpoint SBA; Also, since our laptop endpoints are off network so often, I am interested in testing the endpoints on their own..

Re: Tools / Methods to Test SBA?

PhoneBoy — Sat, 24 Mar 2018 20:42:45 GMT

I'm not aware of any Check Point-produced tools that do this, but a quick Internet search brought up a few.