Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Christopher_Wis
Employee Alumnus
Employee Alumnus

Has anyone written a script to add indicators of compromise?

I am demo'ing R80.10 and the customer asked about adding IOC's. The API documentation indicates that this functionality does not exist. Is this going to be changed in the near future? Are there any work arounds available?

0 Kudos
1 Reply
Timothy_Hall
Legend Legend
Legend

Have you checked out the Anti-bot blade?   This is a post-infection blade that should do what you want, however there is no direct way to add indicators/signatures to that blade specifically.  You could however add a custom SNORT-based signature to the IPS blade if you are looking for something specific.

--

My book "Max Power: Check Point Firewall Performance Optimization"

now available via http://maxpowerfirewalls.com.

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events