- CheckMates
- :
- Non-English Discussions
- :
- Chinese 中文
- :
- New Exploits for Unsecure SAP Systems, How to impo...
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×
Sign in with your Check Point UserCenter/PartnerMap account to access more great content and get a chance to win some Apple AirPods! If you don't have an account, create one now for free!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
New Exploits for Unsecure SAP Systems, How to import Snort rule
Hello all,
近期US-Cert發佈了SAP系統的一個新漏洞:
https://www.us-cert.gov/ncas/alerts/AA19-122A
有客戶詢問到Check Point如何進行防禦(How to Prevent);US-Cert已經先發佈了此攻擊相關的Snort Rule:
R80.10版本之後的客戶可以透過SmartConsole直接匯入來阻擋攻擊,步驟如下:
Step.1 將上方的Snort rule(可以在上方的US-Cert網頁複製)貼到記事本,並另存成 「XXX.rules」 Snort檔案格式。
Step.2 登入SmartConsole,切換到Security Policies頁籤,點選Threat Prevention policy,下方會有IPS Protectections的連結,點選上方的Action >> Snort Protections >> Import Snort rules >> 選擇剛剛另存的Snort rule:
Step.3 匯入之後左下角Task會顯示匯入的進度:
Step.4 匯入完成之後,在IPS Protections裡面即可以查詢到剛剛匯入的Snort特徵碼:
Step.5 進行Profile的設定之後就可以Install Policy開始進行防禦了。
0 Replies
