Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Danny
Champion Champion
Champion

Cyber Attack Views in SmartEvent

Check Point finally released the R80.10 GA version of his

Cyber Attack View Addon for SmartEvent (sk134634).

[ Download ]

The Beta-Version was also shared with and tested by the CheckMates community in this blog entry from April 2018.

The additional view, now made available, helps you to better understand how to investigate threat prevention attacks in your organization. Usualy, One of the major tasks of a threat hunter is to find the needle in the haystack inside a big amount of event Check Point technologies create for him. In most cases, the admin is the one who responsible also to query the events we create for him and understand the threat landscape of his organization. The Cyber Attach View is focusing on an automatic threat analysis using SmartView/SmartEvent.

How to import the cyber-attack view into SmartEvent?

R80.10 GA does not include the cyber-attack view, thus it's required to import it into SmartEvent. Follow these steps to import and generate the latest views:

  1. Download the cyber-attack view from this link.
  2. Extract the cpr file into a directory.
  3. Open SmartView Monitor or SmartConsole (Logs & Monitors) > In the left tree, click on Views.
  4. On the toolbar, click on Actions > Click on Import Template > Select the new template file (Cyber_Attack_View.cpr) and import the template (*.cpr).
  5. The new template should appear in the list.
  6. Double-click the template to generate the view.
8 Replies
_Val_
Admin
Admin

Very useful, thanks, Danny Jung

0 Kudos
jose_monge
Explorer

good, report.

0 Kudos
Matlu
Advisor

Hi, @Danny 
I would like to be able to use this report template.
How can I get the template to run it in my environment?
I have 2 MDS boxes, with multiple CMA.
Is it possible to get this report template, please?
Thank you.

0 Kudos
Amir_Senn
Employee
Employee

Integrated into new version + updated link:

https://support.checkpoint.com/results/sk/sk134634

Kind regards, Amir Senn
0 Kudos
Matlu
Advisor

Hello, @Amir_Senn 
In an MDS environment, this is 'loaded' in the 'Logs&Monitor' section of the main (MDS) box and replicated in all the CMA's I have?
Or does it have to be loaded, one by one, in each CMA?
I have a lot of CMAs and I am wondering how to load it.
Thanks

0 Kudos
Amir_Senn
Employee
Employee

You can upload to MDS and use share and it would should be uploaded to CMAs as well.

But you should have it already:

Capture.PNG

Kind regards, Amir Senn
0 Kudos
Matlu
Advisor

An inquiry
These custom reports help me with the 'Threat Prevention' part, right?
Basically my need is to 'see' what is related to attacks, where blades such as IPS, AV, AB intervene, since my client has been exposed to attacks and information leakage to the Internet.
Do these custom reports help me?

0 Kudos
Amir_Senn
Employee
Employee

Will help you with anything detected/prevented by the Threat Prevention blades.

If you have security issues related to Access Control it will not help with that.

For best practices that will help you avoid such vulnerabilities you might want to check Compliance blade as well.

Kind regards, Amir Senn
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events