topic Access to infected resources before signature is created in Endpoint

Access to infected resources before signature is created

gander — Tue, 28 Nov 2023 18:56:21 GMT

Hello,

What is the proper way to manage infections occurring because no signature have yet been created and sandbox didn't block it?

In my sense, there should be a way to analyze previous access with newly created signatures and generate alerts

Re: Access to infected resources before signature is created

PhoneBoy — Tue, 28 Nov 2023 23:47:47 GMT

Signatures require traffic to match against, which you obviously won't have after the fact.
The only thing you might have are IPs and URLs accessed, which could theoretically be "re-analyzed" after the fact.
Our XDR offering includes some additional tools that may be useful in such situations: https://www.checkpoint.com/horizon/xdr-xpr/

Re: Access to infected resources before signature is created

the_rock — Wed, 29 Nov 2023 00:37:50 GMT

I see what Phoneboy is saying. I watched presentation Sales gave about XDR and it definitely could help here.

Best regards,

Andy