topic Re: customer have requirements of integration and automation of external Threat Intelligence in General Topics

customer have requirements of integration and automation of external Threat Intelligence

sureshreddy — Fri, 11 Sep 2020 06:59:32 GMT

Dear Team,

One of our customers has requirements of integration and automation of external Threat Intelligence on Checkpoint, for example, Cisco Talos, Kaspersky, virus total, etc. or from the Threat Intelligence Server managed locally by using API. So, is this possible on Checkpoint?

Your help in this regard will be greatly appreciated.

Re: customer have requirements of integration and automation of external Threat Intelligence

PhoneBoy — Mon, 14 Sep 2020 04:32:18 GMT

This can be automated, yes.
There are a couple of options available:

Threat Prevention APIs (e.g. add threat-indicator)
ioc_feeds on the gateway

I believe R81 will have additional options available as well.
Note that our Threat Prevention blades pull from ThreatCloud which includes several third party sources already (though we don't disclose the exact parties).