My security team wants to be able to replay traffic (I don't know how they would) from the past to see what got thru before Check Point started preventing traffic. For damage control and auditing. I responded that we have logs, we don't have the traffic. But I am curious RE: forensics how teams go back and look for damage even a month before detection.
Also, this question came up because they want to look for clues in old logs. Does Check Point show what they are checking for pattern management detection? I assume no - it's proprietary like the KFC recipe.
