- CheckMates
- :
- Products
- :
- Quantum
- :
- Threat Prevention
- :
- Re: Anti-Bot IP Reputation
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Anti-Bot IP Reputation
Hi Everybody,
Anti-bot Protection contains IP, URLs, Domain reputation list.
I can generate URLs and DNS reputation logs easily, but cannot generate IPs reputation logs without using indicator files/external IOC feed.
How can I generate IPs reputation logs without using indicator files/ external IOC feed. Is it possible to do ?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For background what are you trying to achieve, are you trying to confirm a protection works as expected or do you need the log record as a template?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Chris,
I access "http(s)://131.188.40.189" , the traffic can be block by Anti-bot (URL Reputation). but ping 131.188.40.189 or telnet 131.188.40.189 25, the traffic goes through.
Can I generate IPs reputation logs on production? I try several times but not luck.
What kind of tests can trigger IPs reputation logs?
Is it possible to create IPs reputation log record via Threatwiki page for demo?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
HI Chris
in this example. according to "https://urlcat.checkpoint.com/urlcat/main.htm".
if i enter the ip "131.188.40.189", it will be shown URL Reputation not IP Reputation.
The Anti-bot Protection name (Reputation IP/Reputation URLs / Reputation Domain) confuses me.
As far as I know
1. Reputation IP => xxx.xxx.xxx.xxx
2. Reputation URLs => www.bot.com/xxx.exe
3. Reputation Domain => www.bot.com
For this case, if we want to show log of "Reputation IP" in the Logs and Monitoring, would it be possible?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For context:
What confidence level is the profile/blade set to enforce?
Also are the protections correctly reporting up to date in the necessary areas/domain per sk171644.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My setting as below
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This thread is about Gateway protections
Whereas your video is Endpoint or must I keep watching to a particular timestamp?
If for Endpoint I suggest starting a new thread.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
you rught mine for endpoint
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you trying to find a known IP that will trigger the Reputation IP protection?
In any case, the focus of Anti-Bot is DNS, SMTP, and HTTP(S), as noted here: https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.SearchResultMainAction&eve...
Best practice is to limit outbound Internet connectivity to the precise services needed.
Meanwhile you might try a DNS lookup to the IP (assuming the lookup goes through the gateway) or initiate an SMTP connection to it.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi PhoneBoy,
We have a lots of "Reputation IPs" for Anti-Bot Protection show as below, but never see "IP reputation" type on log.
Is it possible to generate "IPs reputation logs" without using indicator files/ external IOC feed?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Not as far as I know because of how the decision to block is made (IP Reputation being just one factor).
When you use an external indicator feed and block based purely on that, we can make the clear statement in the logs that it's an "IP Reputation" reason.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Was this screenshot from demo mode or elsewhere the protections look out of date by 6-months at the time of posting (refer: sk171644)?