AI Agent - Rule/object creation assistant

[erankov]

Hello everyone,

My name is Eran and I am a product manager @ Check Point, 

I am working on developing an AI agent that "listens" to modifications in the rule base or objects of the firewall and assists users with the creation process (similar to the validation process)

The initial concept is for this agent was to learn the conventions used by the customer and recommend improvements on how to better write the rules or objects (comments, rule name etc.), but I think that the value here is limited and I'm looking to improve it.

I am looking for ideas on how to enrich this AI agent to make it more valuable to our customers. 

I would love to hear your thoughts and suggestions on how to further enhance this AI agent. Any ideas or feedback would be greatly appreciated!

Thank you, Eran

[the_rock]

Hey Eran,

Awesome job! Im thinking, just an idea, it would be cool if it could detect say low, medium and critical changes, though not 100% certian how that could be classified, maybe by number of rule hits?

Andy

[erankov]

I have a few thoughts on this:

1. As for hit count, I don't have that during the modification of the rule. 

2. score each rule by the exposure it provides (an 'Any' rule would provide higher exposure so higher score) - and based on the additional change to the rule we can provide scoring to the new modification, and the exposure level it provides (can add additional factors like risky protocols and access from untrusted zones).

2. somehow map vulnerabilities to the change and score them

For both ideas, I try to think of the value to the customers... not sure