Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Sergej_Gurenko
Collaborator

IOC feeds: how to monitor and escalate issues? How to get alerts from ioc_feeder.elg to Service Desk

Hello,

I read several posts What is the maximum IOC feed range? and IOC Feeds does not work properly, describing potential issues with IOC feeds on older Check Point software. It is looks like all IOC feed suscess and failure erros are stored in ioc_feeder.elg

There are two scenarios i'm seeking assistance with:

  • Alerting traditional NOC if the feature is not working or is degraded. And further escalation via the ticket.
  • Alerting MDR analysts that the IOC feed is successfully imported and processed by the gateways. The analysts could modify and update IOC files by hand or using semi-automated playbooks and security tools.

Can you please suggest on reliable option for getting the significant errors from ioc_feeder.elg to (Service Desk) tools.

We can use scheduled SNMP polls, email integration or other old school methods.For example less preferred syslog alerts and SNMP-traps (as less reliable). We have not tried Skyline (OpenTelemetry prometheus grafana) yet and do not integrate with Infinity Portal for co-management. I read that *.ELG is a plain text file.

Regards, Serg

0 Kudos
6 Replies
Henrik_Noerr1
Advisor

Hey,

All our firewall logs are sent to an elastic instance with the log exporter. From here we have set up alerts on various logs. So when IOC stops working the firewall logs it, and we sent a webhook from elastic to our ITSM with relevant info.

 

Furthermore we have a query every X minute from a tooling server, that queries an item agreed to be in the feed. The query should be stopped. If it is not, we sent an alert to our ITSM system.

 

/Henrik

(1)
Sergej_Gurenko
Collaborator

I think it is an excellent hint to pre-provision a bunch of test remote destinations and hand over the details to the analysts. Rather than testing if  (potentially dangerous) malicious URL is blocked, the analysts can test the harmless test URLs.

0 Kudos
Sergej_Gurenko
Collaborator

Add-on question: Does anyone know if a single error in the feed file blocks the update/refresh or if lines with the errors are ignored while the incorrect lines are pushed? The documentation does not provide a clear answer. Especially the "sk165932 "IOC_FAILED_WHILE_PARSING" error message when the Custom Intelligence Feeds automatic process fails after editing the source file" gives me the impression this is a bug.

From the documentation:

"IOC_FAILED_WHILE_PARSING" error message when Custom Intelligence Feeds automatic process fails after editing source file.
When adding an IP address, or domain, to the list, the system does not block the new address (still blocks the existing entries), and shows a parsing error: "IOC_FAILED_WHILE_PARSING"

0 Kudos
Sergej_Gurenko
Collaborator

If anyone is interested, i tested it in the lab. When detected, the lines with errors are ignored, and the rest of the feed is applied. Single error does not stop the fewst of the IOC file to be processed.

Errors are stored in *_custom.csv.err file on the gateways.

Even so, the details about the updates of the feed files are only available in ioc_feeder.elg log file on the Gateway, the most important is forwarded to SmartConsole fw.log file.

Smart Console events:

Picture1.png

 

Picture2.png

Sergej_Gurenko
Collaborator

Hello Experts, does anyone know if one can generate alerts from _specific_ messages in the SmartConsole fw.log file?

Thinking about handling IOC errors by firing Emails or SNMP traps to the monitoring platform.

 
 

alerts.jpg

0 Kudos
PhoneBoy
Admin
Admin

The filtering would have to occur in a script, sending mail or snmp trap only when specific messages are encountered.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    Tue 23 Apr 2024 @ 08:00 AM (CDT)

    South US: HTTPS Inspection Best Practices

    Tue 23 Apr 2024 @ 11:00 AM (EDT)

    East US: What's New in R82

    Thu 25 Apr 2024 @ 11:00 AM (SGT)

    APAC: CPX 2024 Recap

    Tue 30 Apr 2024 @ 03:00 PM (CDT)

    EMEA: CPX 2024 Recap

    Tue 23 Apr 2024 @ 08:00 AM (CDT)

    South US: HTTPS Inspection Best Practices

    Tue 23 Apr 2024 @ 11:00 AM (EDT)

    East US: What's New in R82

    Thu 25 Apr 2024 @ 11:00 AM (SGT)

    APAC: CPX 2024 Recap

    Tue 30 Apr 2024 @ 03:00 PM (CDT)

    EMEA: CPX 2024 Recap

    Thu 02 May 2024 @ 11:00 AM (SGT)

    APAC: What's new in R82
    CheckMates Events