The only Check Point product that we are utilizing is the Sandblast Agent - Advanced via cloud management. I can definitely see evidence of Check Point working to flesh out their cloud solution but as of right now there are areas that seem very limited. One such area is incident alerting.
I was curious what everyone else is doing to stay up to date on infection alerts to that they can be promptly handled? Right now it seems that without a SIEM you will basically need to have the console open 24/7 and constantly refresh it to be aware of any new incidents. The built in alerting for "The computer is infected" seems to be too specific and won't alert for blades like Behavior Guard/Anti-Ransomware.
The ideal alert is when an "active" threat is discovered I will receive an email with the PC name, user, and threat so that we can be aware and start to remediate.
I look forward to hearing everyone's feedback!
Thank you!
