- Products
- Learn
- Local User Groups
- Partners
-
More
Celebrate the New Year
With CheckMates!
Value of Security
Vendor Self-Awareness
Join Us for CPX 360
23-24 February 2021
Important certificate update to CloudGuard Controller, CME,
and Azure HA Security Gateways
How to Remediate Endpoint & VPN
Issues (in versions E81.10 or earlier)
Mobile Security
Buyer's Guide Out Now
Important! R80 and R80.10
End Of Support around the corner (May 2021)
Hi everyone,
I've just enabled Content Awarness blade and it's a very useful blade to see what files are being transferred inbound and outbound in company e-mail system.
When I started to search and analyze the logs, I became aware that there is no forensic e-mail data like most important sender,and recipient fields... Without sender and recipient information in an e-mail security log file it's useless, cause it's like a FW log without source and destination.
As a matter of course, I asked this feature to local CP Tukey support and they escalated my question to CP Global. The answer is below which never satisfies me:
Hello Turgut
Here you are our develepor replay for your Issue
-You will only see sender and received when the Email is destined to the Check Point MTA.
-MTA supports TE. AV and Anti-Spam.
-Content awareness will not work with MTA and the Emails are processed in streaming mode (smtp). Therefore the logs will not show sender and receiver details
Regards,
Medhat Girgis – Technical Support Engineer
As a customer I'm willing the to have forensic e-mail security related data fields in SmartLog and also willing to have e-mail related syntax (like receipt, sender, subject etc) for Threat Emulation, Threat Extraction,Anti-Spam & E-Mail Security, Content Awareness blades and features.
Thanks
Evren Buyer
I know in general we are looking to improve our MTA support.
There are some MTA features mentioned here: Check Point R80.20 Production and Public EA
Question: if the MTA supported Content Awareness, would you use it?
Or do you just want Content Awareness (or some other blade) to log the SMTP details?
Hi Dameon,
My answer is gonna be ABSOLUTELY YES I will use it...
May I be a volunteer for the Production and Public EA? How am I supposed to do that?
Cause like Small business companies one of which I currently work for, they never like to pay so much for Security products, CP has great solutions; I know there are many different security MTAs etc. but CP did well to collect them under one product with different blades. I also use different products like Trend Micros IMSVA solution as a second Security Layer in my mail system, which can be supported with anti-ransomware products...
And also; positioning the CP in the middle of a star-topology like in my environment is the BEST...
I think I love my CP and that's why requesting, demanding more from it...!
Benefits of CP that attracts me to use:
1) Correlated Rule base also correlated logs and management
2) Different layers different security solutions (Mail, application, FW, VPN, IPS etc)
3) Easy to coordinate with other products
4) And the MOST IMPORTANT---> All it's blades work trustfully, fast, constant and stable...
5) Great forensic features in one hand
Evren Buyer
The request to the EA went to the right place.
But still there is neither an answer nor reply from @EA_support
About CheckMates
Learn Check Point
Advanced Learning
WELCOME TO THE FUTURE OF CYBER SECURITY