Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Evren_Buyer
Contributor

Is there a way to see recipient and sender forensic data in Content Awarness blade logs?

Hi everyone,

I've just enabled Content Awarness blade and it's a very useful blade to see what files are being transferred inbound and outbound in company e-mail system.

When I started to search and analyze the logs, I became aware that there is no forensic e-mail data like  most important sender,and recipient fields... Without sender and recipient information in an e-mail security log file it's useless, cause it's like a FW log without source and destination.

As a matter of course, I asked this feature to local CP Tukey support and they escalated my question to CP Global. The answer is below which never satisfies me:

Hello Turgut

Here you are our develepor replay for your Issue 

-You will only see sender and received when the Email is destined to the Check Point MTA.
-MTA supports TE. AV and Anti-Spam.
-Content awareness will not work with MTA and the Emails are processed in streaming mode (smtp). Therefore the logs will not show sender and receiver details

Regards,

Medhat Girgis – Technical Support Engineer

As a customer I'm willing the to have forensic e-mail security related data fields in SmartLog and also willing to have e-mail related syntax (like receipt, sender, subject etc) for Threat Emulation, Threat Extraction,Anti-Spam & E-Mail Security, Content Awareness blades and features.

Thanks

Evren Buyer

‌ threat extraction

6 Replies
PhoneBoy
Admin
Admin

I know in general we are looking to improve our MTA support.

There are some MTA features mentioned here: Check Point R80.20 Production and Public EA

Question: if the MTA supported Content Awareness, would you use it?

Or do you just want Content Awareness (or some other blade) to log the SMTP details?

Evren_Buyer
Contributor

Hi Dameon,

My answer is gonna be ABSOLUTELY YES I will use it...

May I be a volunteer for the Production and Public EA? How am I supposed to do that?

Cause like Small business companies one of which I currently work for, they never like to pay so much for Security products, CP has great solutions;  I know there are many different security MTAs etc. but CP did well to collect them under one product with different blades. I also use different products like  Trend Micros IMSVA solution as a second Security Layer in my mail system, which can be supported with anti-ransomware products...

And also; positioning the CP in the middle of a star-topology like in my environment is the BEST...

I think I love my CP and that's why requesting, demanding more from it...! Smiley Happy

Benefits of CP that attracts me to use:

1) Correlated Rule base also correlated logs and management

2) Different layers different security solutions (Mail, application, FW, VPN, IPS etc)

3) Easy to coordinate with other products

4) And the MOST IMPORTANT---> All it's blades work trustfully, fast, constant and stable...

5) Great forensic features in one hand

Evren Buyer

PhoneBoy
Admin
Admin

The request to the EA went to the right place. Smiley Happy

0 Kudos
Evren_Buyer
Contributor

But still there is neither an answer nor reply from @EA_support Smiley Happy

Bubba_95
Explorer
Explorer

Hi @Evren_Buyer r Did you have the possibility to try Content Awarness on MTA?

@PhoneBoy  there are some news in EA about this functionality?

 

 

Thanks

0 Kudos
PhoneBoy
Admin
Admin

As far as I know, Content Awareness is still not supported in MTA for the reasons mentioned above.
The EA features related to MTA above were released as part of R80.20 and should be available in later releases.
R80.30 and R80.40 also added additional MTA functionality, mostly Threat Prevention related.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events