- CheckMates
- :
- Products
- :
- Quantum
- :
- Threat Prevention
- :
- Re: R81.20 and STIX File Imports (CISA)
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
R81.20 and STIX File Imports (CISA)
Just starting to look into STIX files and getting our firewalls a little more smarter and importing feeds from outside sources. My first task is to try and get the CISA alert STIX files imported. I was hoping it was as easy as just importing the files but there looks to be specific CheckPoint values missing that is causing issues. When I import the file, everything is assigned to the 'Anti-Virus' product and I assume that's why when I was testing with my IP, nothing was being detected. I couldn't find a good example of how to get these categories set properly in my STIX file and/or if there was a way to easily massage the CISA (or other party) STIX files into a CheckPoint approved format?
For example, just playing with this latest notice and the STIX file attached: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a
Was following this doc and see that IP should be set to Anti-Bot but just not sure how: https://support.checkpoint.com/results/sk/sk132193
See attached on how it imports.
We're running R81.20 for management and the gateways in the cluster.
- Labels:
-
Threat Indicators
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Looks like it's importing the file correctly.
Imported indicators will be enforced in Anti-Virus, so it's expected that will show.
Not clear what it is you are expecting to see here.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi PhoneBoy,
When the observables were loaded and I tested against my IP accessing a web server in our DMZ, there were no detects on my IP which made me believe that it is not working properly. My theory was, after reading SK132193, the observables needed to be assigned the correct software blade. For an IP, according to the SK, it should be on the Anti-Bot and not the Anti-Virus, which is what it defaulted to.
Observable Type | Software Blade | Full Software Blade Name |
URL | AV/AB | Anti-Virus / Anti-Bot |
Domain | AV/AB | Anti-Virus / Anti-Bot |
IP | AB | Anti-Bot |
IP Range | AB | Anti-Bot |
MD5 | AV | Anti-Virus |
Mail-subject | AV/AB | Anti-Virus / Anti-Bot |
Mail-from | AV/AB | Anti-Virus / Anti-Bot |
Mail-to | AV/AB | Anti-Virus / Anti-Bot |
Mail-cc | AV/AB | Anti-Virus / Anti-Bot |
Mail-reply-to | AV/AB | Anti-Virus / Anti-Bot |
SHA1 | AV | Anti-Virus |
SHA256 | AV | Anti-Virus |
Snort | IPS | IPS |
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I just did a CSV import with my IP and assigned it the Anti-Bot for the Product instead of the default Anti-Virus and I'm still not getting any detects when browsing to our web servers. Maybe it doesn't work as I think it would? Do the threat indicators detect/prevent inbound connections? I did confirm that my Bot and Virus profiles have the 'Enable Indicator Scanning' checked.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It's supposed to block inbound connections (as of R81), yes.
Recommend engaging with TAC here: https://help.checkpoint.com
