topic Re: IoA rules in Endpoint

IoA rules

RS_Daniel — Wed, 20 Mar 2024 22:47:51 GMT

Hello!

I was looking for some info about creating IoA rules with Harmony Endpoint or XDR/XPR but i was not able to find something about this. I think it is not possible but wanted to ask here.

I am looking something similar to this:

https://youtu.be/75E_edpAmp4?list=PLtojL19AteZv3oYq8_jD_0J5vNvxdGDDs

If someone has any info please it would be great.

Regards

Re: IoA rules

_Val_ — Mon, 25 Mar 2024 08:42:40 GMT

Sure, look here: https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/IOC-Admin-Guide/Content/Topics/Introduction.htm?TocPath=Introduction%20to%20Infinity%20IoC%7C_____0#Introduction_to_Infinity_IoC

Re: IoA rules

RS_Daniel — Mon, 25 Mar 2024 12:36:19 GMT

Hello Val,

Thanks for the info. However that is not what we are looking for. We wanted some feature to create custom behavorial rules, as in the video example, where creating some process from CMD was defined manually as a malicious behavior and that was blocked, these kind of rules can not be created with IoC's currently.

Regards