topic Re: Creating Malicious URL in General Topics

Creating Malicious URL

ihenock101 — Mon, 02 Jan 2023 09:04:30 GMT

I have checkpoint firewall and when I create custom application/sites by default it creates services like http, https, HTTP_proxy, and HTTPS_proxy and I have two questions regarding this, the first one is what are this services used for in the Application/sites the second is usually I used to block malicious or suspicious urls through this application/sites object category the question is which place is best to place these app/sites groups either on the destination or in the services section on the rule base?

Regards,

Re: Creating Malicious URL

G_W_Albrecht — Mon, 02 Jan 2023 09:27:50 GMT

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuide/Content/Topics-SECMG/Creating-Application-Control-and-URL-Filtering-Rules.htm?tocpath=Creating%20an%20Access%20Control%20Policy%7C_____6

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk112249

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk73220

Re: Creating Malicious URL

Chris_Atkinson — Mon, 02 Jan 2023 12:22:20 GMT

Those services typically represent the default ones to which URL filtering / AppC policy is applied unless you have the non-standard ports option enabled.

The latter depends on the object type, "domain" objects can be used in the destination of a FW/Access policy but a site/category is typically in the services column depending on the blades enabled.

Re: Creating Malicious URL

PhoneBoy — Mon, 02 Jan 2023 14:32:10 GMT

There are a couple different ways to block URLs:

Adding them as part of Custom Application/Site objects in the Access Policy (requires a policy install to change)
Using ioc_feeds with the AV/AB Blades: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk132193&partition=Basic&product=Anti-Virus,
In R81.20, using a Network Feed object: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuide/Content/Topics-SECMG/Network_Feed.htm?Highlight=Network%20feed

ioc_feeds doesn’t use the Access Policy at all.
For the other two methods, you can put the relevant object in the Access Policy with appropriate rules to block traffic to and from those IPs.