https://community.checkpoint.com/t5/Endpoint/Endpoint-visibility-favorite-queries/m-p/156991#M6059 <P>Hello CheckMates,</P> <P>Recently we were reviewing some endpoint logs for a white hat phishing campaign that was being performed on one of our customers.&nbsp; Apparently the group was able to acquire a lot of domain credentials even though anti-phishing was on in prevent.&nbsp; Upon further research the endpoint performed flawlessly because everything that was protected by Check Point was prevented.&nbsp; However, this didn't stop the users from going to their mobile phone and entering their domain creds.&nbsp; That was an eye-opener for the client.</P> <P>However, while we were in there investigating we noticed a few users that were reusing corporate credentials.&nbsp; We get a weekly report from Check Point that shows critical blocks/detects, the noisiest systems how many times this or that happened and a lot of "high risk" stuff.&nbsp; But what about the other things that slide under the radar?</P> <P>My question is this.&nbsp; If you paste&nbsp;("Corporate password%") into the endpoint log, you will see all of the people that attempted to or actually did use internal credentials on external sites.&nbsp; This clearly would draw some concern and maybe even require a chat with the end user about best practices, additional training, etc.&nbsp; What other valuable queries like that are there that provide visibility and value to an endpoint administrator other than the TOP10 or the most critical....canned reports.</P> <P>Does anyone else have any favorites they use for endpoint?</P> <P>Thanks,<BR />Paul</P> Sun, 11 Sep 2022 17:07:58 GMT Paul_Warnagiris 2022-09-11T17:07:58Z https://community.checkpoint.com/t5/Endpoint/Endpoint-visibility-favorite-queries/m-p/156991#M6059 <P>Hello CheckMates,</P> <P>Recently we were reviewing some endpoint logs for a white hat phishing campaign that was being performed on one of our customers.&nbsp; Apparently the group was able to acquire a lot of domain credentials even though anti-phishing was on in prevent.&nbsp; Upon further research the endpoint performed flawlessly because everything that was protected by Check Point was prevented.&nbsp; However, this didn't stop the users from going to their mobile phone and entering their domain creds.&nbsp; That was an eye-opener for the client.</P> <P>However, while we were in there investigating we noticed a few users that were reusing corporate credentials.&nbsp; We get a weekly report from Check Point that shows critical blocks/detects, the noisiest systems how many times this or that happened and a lot of "high risk" stuff.&nbsp; But what about the other things that slide under the radar?</P> <P>My question is this.&nbsp; If you paste&nbsp;("Corporate password%") into the endpoint log, you will see all of the people that attempted to or actually did use internal credentials on external sites.&nbsp; This clearly would draw some concern and maybe even require a chat with the end user about best practices, additional training, etc.&nbsp; What other valuable queries like that are there that provide visibility and value to an endpoint administrator other than the TOP10 or the most critical....canned reports.</P> <P>Does anyone else have any favorites they use for endpoint?</P> <P>Thanks,<BR />Paul</P> Sun, 11 Sep 2022 17:07:58 GMT https://community.checkpoint.com/t5/Endpoint/Endpoint-visibility-favorite-queries/m-p/156991#M6059 Paul_Warnagiris 2022-09-11T17:07:58Z