Access to infected resources before signature is created

[gander]

Hello,

What is the proper way to manage infections occurring because no signature have yet been created and sandbox didn't block it?

In my sense, there should be a way to analyze previous access with newly created signatures and generate alerts

[PhoneBoy]

Signatures require traffic to match against, which you obviously won't have after the fact.
The only thing you might have are IPs and URLs accessed, which could theoretically be "re-analyzed" after the fact.
Our XDR offering includes some additional tools that may be useful in such situations: https://www.checkpoint.com/horizon/xdr-xpr/ 

[the_rock]

I see what Phoneboy is saying. I watched presentation Sales gave about XDR and it definitely could help here.

Best regards,

Andy