Create a Post
Showing results for 
Search instead for 
Did you mean: 

using IPS engine for replaying older traffic

My security team wants to be able to replay traffic (I don't know how they would) from the past to see what got thru before Check Point started preventing traffic.  For damage control and auditing.   I responded that we have logs, we don't have the traffic.  But I am curious RE: forensics how teams go back and look for damage even a month before detection.

Also, this question came up because they want to look for clues in old logs.  Does Check Point show what they are checking for pattern management detection?  I assume no - it's proprietary like the KFC recipe.


0 Kudos
1 Reply
Employee Employee

Replaying traffic in a lab environment is one thing but as you say where is the traffic capture coming from as we don't blindly store it?

Refer: tcpreplay tool 


Horizon NDR might be something the team is interested in investigating further.

0 Kudos
Upcoming Events

    CheckMates Events