using IPS engine for replaying older traffic

Daniel_Kavan — Fri, 28 Oct 2022 15:32:54 GMT

My security team wants to be able to replay traffic (I don't know how they would) from the past to see what got thru before Check Point started preventing traffic. For damage control and auditing. I responded that we have logs, we don't have the traffic. But I am curious RE: forensics how teams go back and look for damage even a month before detection.

Also, this question came up because they want to look for clues in old logs. Does Check Point show what they are checking for pattern management detection? I assume no - it's proprietary like the KFC recipe.

Re: using IPS engine for replaying older traffic

Chris_Atkinson — Sat, 29 Oct 2022 01:41:45 GMT

Replaying traffic in a lab environment is one thing but as you say where is the traffic capture coming from as we don't blindly store it?

Refer: tcpreplay tool

Horizon NDR might be something the team is interested in investigating further.

topic using IPS engine for replaying older traffic in Off Topic

using IPS engine for replaying older traffic

Re: using IPS engine for replaying older traffic