Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Daniel_Kavan
Advisor

using IPS engine for replaying older traffic

My security team wants to be able to replay traffic (I don't know how they would) from the past to see what got thru before Check Point started preventing traffic.  For damage control and auditing.   I responded that we have logs, we don't have the traffic.  But I am curious RE: forensics how teams go back and look for damage even a month before detection.

Also, this question came up because they want to look for clues in old logs.  Does Check Point show what they are checking for pattern management detection?  I assume no - it's proprietary like the KFC recipe.

 

0 Kudos
1 Reply
Chris_Atkinson
Employee Employee
Employee

Replaying traffic in a lab environment is one thing but as you say where is the traffic capture coming from as we don't blindly store it?

Refer: tcpreplay tool 

 

Horizon NDR might be something the team is interested in investigating further.

CCSM R77/R80/ELITE
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events