{"id":92913,"date":"2020-09-01T13:42:56","date_gmt":"2020-09-01T11:42:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting"},"modified":"2020-09-01T13:42:56","modified_gmt":"2020-09-01T11:42:56","slug":"5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","title":{"rendered":"5. Check Point SandBlast Agent Management Platform. Protokoly, zpr\u00e1vy & forenzn\u00ed anal\u00fdza. Lov na hrozby","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"5.
\n
\nV\u00edtejte u p\u00e1t\u00e9ho \u010dl\u00e1nku cyklu o \u0159e\u0161en\u00ed Check Point SandBlast Agent Management Platform. Se star\u0161\u00edmi \u010dl\u00e1nky se m\u016f\u017eete sezn\u00e1mit kliknut\u00edm na odpov\u00eddaj\u00edc\u00ed odkaz: prvn\u00ed<\/a><\/noindex>, druh\u00e1<\/a><\/noindex>, t\u0159et\u00ed<\/a><\/noindex>, \u010dtvrt\u00e1<\/a><\/noindex>. Dnes se zam\u011b\u0159\u00edme na mo\u017enosti monitorov\u00e1n\u00ed v Management Platform, konkr\u00e9tn\u011b na pr\u00e1ci s logy, interaktivn\u00edmi dashboardy (View) a reporty. Tak\u00e9 se dotkneme t\u00e9matu Threat Hunting pro identifikaci aktu\u00e1ln\u00edch hrozeb a anom\u00e1ln\u00edch ud\u00e1lost\u00ed na u\u017eivatelsk\u00e9m stroji.
\n<\/a><\/noindex><\/p>\n

Protokoly<\/h2>\n

\nHlavn\u00edm zdrojem informac\u00ed pro monitorov\u00e1n\u00ed bezpe\u010dnostn\u00edch ud\u00e1lost\u00ed je sekce Logs, kter\u00e1 zobrazuje podrobnosti o ka\u017ed\u00e9m incidentu a tak\u00e9 umo\u017e\u0148uje pou\u017e\u00edvat pohodln\u00e9 filtry pro up\u0159esn\u011bn\u00ed krit\u00e9ri\u00ed hled\u00e1n\u00ed. Nap\u0159\u00edklad kliknut\u00edm prav\u00fdm tla\u010d\u00edtkem my\u0161i na parametr (Blade, Action, Severity atd.) po\u017eadovan\u00e9ho logu lze tento parametr filtrovat jako Filtr: \u00abParameter\u00bb<\/i> nebo Filtrovat: \u00abParameter\u00bb<\/i>. Pro parametr Source lze tak\u00e9 zvolit mo\u017enost IP Tools, v n\u00ed\u017e lze spustit ping na tuto IP adresu\/jm\u00e9no nebo prov\u00e9st nslookup pro z\u00edsk\u00e1n\u00ed IP adresy zdroje podle jm\u00e9na.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

V sekci Logs pro filtrov\u00e1n\u00ed ud\u00e1lost\u00ed je podsekce Statistics, kde se zobrazuje statistika ke v\u0161em parametr\u016fm: \u010dasov\u00fd graf s po\u010dtem log\u016f a procentn\u00ed pod\u00edly podle ka\u017ed\u00e9ho z parametr\u016f. Z t\u00e9to podsekce lze snadno filtrovat logy bez nutnosti oslovovat vyhled\u00e1vac\u00ed pole a ps\u00e1t v\u00fdrazy filtru \u2014 sta\u010d\u00ed vybrat zaj\u00edmav\u00e9 parametry a nov\u00fd seznam log\u016f se okam\u017eit\u011b zobraz\u00ed.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Podrobn\u00e9 informace o ka\u017ed\u00e9m p\u0159ehledu jsou k dispozici v prav\u00e9m panelu sekce Logs, nicm\u00e9n\u011b pohodln\u011bj\u0161\u00ed je otev\u0159en\u00ed p\u0159ehledu dvojit\u00fdm kliknut\u00edm pro anal\u00fdzu obsahu. N\u00ed\u017ee je uveden p\u0159\u00edklad p\u0159ehledu (obr\u00e1zek je klikac\u00ed), ve kter\u00e9m jsou zobrazeny podrobn\u00e9 informace o ud\u00e1losti Prevent b\u0159itvy Threat Emulation na infikovan\u00fd soubor \".docx\". P\u0159ehled m\u00e1 n\u011bkolik podsekc\u00ed, kter\u00e9 zobrazuj\u00ed detaily bezpe\u010dnostn\u00ed ud\u00e1losti: aktivn\u00ed politika a ochrana, detaily forenziky, informace o klientovi a provozu. Zvl\u00e1\u0161tn\u00ed pozornost si zaslou\u017e\u00ed dostupn\u00e9 reporty z p\u0159ehledu \u2014 Threat Emulation Report a Forensics Report. Tyto reporty lze tak\u00e9 otev\u0159\u00edt z klienta SandBlast Agent.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Threat Emulation Report<\/h3>\n

\n\"5.<\/a><\/noindex><\/p>\n

Pou\u017eit\u00ed modulu Threat Emulation po proveden\u00ed emulace v cloudu Check Point zobraz\u00ed v p\u0159\u00edslu\u0161n\u00e9m logu odkaz na podrobnou zpr\u00e1vu o v\u00fdsledc\u00edch emulace \u2014 Threat Emulation Report. Obsah t\u00e9to zpr\u00e1vy je podrobn\u011b pops\u00e1n v na\u0161em \u010dl\u00e1nku o anal\u00fdze malwaru pomoc\u00ed forenziky Check Point SandBlast Network<\/a><\/noindex>. Je t\u0159eba poznamenat, \u017ee tato zpr\u00e1va je interaktivn\u00ed a umo\u017e\u0148uje \"proch\u00e1zet\" podrobnostmi ka\u017ed\u00e9 sekce. D\u00e1le je mo\u017en\u00e9 si prohl\u00e9dnout z\u00e1znam procesu emulace ve virtu\u00e1ln\u00edm stroji, st\u00e1hnout p\u016fvodn\u00ed \u0161kodliv\u00fd soubor nebo z\u00edskat jeho hash, stejn\u011b jako kontaktovat t\u00fdm Incident Response Team Check Point.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Forensics Report<\/h3>\n

\nT\u00e9m\u011b\u0159 pro ka\u017edou bezpe\u010dnostn\u00ed ud\u00e1lost je generov\u00e1na zpr\u00e1va Forensics Report, kter\u00e1 zahrnuje podrobn\u00e9 informace o \u0161kodliv\u00e9m souboru: jeho charakteristiky, akce, m\u00edsto vstupu do syst\u00e9mu a vliv na d\u016fle\u017eit\u00e9 aktiva spole\u010dnosti. Strukturu zpr\u00e1vy jsme podrobn\u011b probrali v \u010dl\u00e1nku o anal\u00fdze malwaru pomoc\u00ed forenziky Check Point SandBlast Agent<\/a><\/noindex>. Takov\u00e1 zpr\u00e1va je d\u016fle\u017eit\u00fdm zdrojem informac\u00ed p\u0159i vy\u0161et\u0159ov\u00e1n\u00ed bezpe\u010dnostn\u00edch ud\u00e1lost\u00ed, a pokud je to nutn\u00e9, lze okam\u017eit\u011b odeslat obsah zpr\u00e1vy do t\u00fdmu Incident Response Team Check Point.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

SmartView<\/h2>\n

\nCheck Point SmartView je pohodln\u00fd n\u00e1stroj pro vytv\u00e1\u0159en\u00ed a prohl\u00ed\u017een\u00ed dynamick\u00fdch dashboard\u016f (View) a zpr\u00e1v ve form\u00e1tu PDF. Z SmartView lze tak\u00e9 zobrazovat u\u017eivatelsk\u00e9 logy a auditn\u00ed ud\u00e1losti pro administr\u00e1tory. Na obr\u00e1zku n\u00ed\u017ee jsou uvedeny neju\u017eite\u010dn\u011bj\u0161\u00ed zpr\u00e1vy a dashboardy pro pr\u00e1ci se SandBlast Agent.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Zpr\u00e1vy ve SmartView p\u0159edstavuj\u00ed dokumenty se statistick\u00fdmi informacemi o ud\u00e1lostech za ur\u010dit\u00e9 \u010dasov\u00e9 obdob\u00ed. Podporuje se export zpr\u00e1v ve form\u00e1tu PDF na stroj, kde je otev\u0159en SmartView, a tak\u00e9 pravideln\u00fd export do PDF\/Excel na e-mail administr\u00e1tora. Krom\u011b toho se podporuje import\/export \u0161ablon zpr\u00e1v, vytv\u00e1\u0159en\u00ed vlastn\u00edch zpr\u00e1v a mo\u017enost skr\u00fdvat jm\u00e9na u\u017eivatel\u016f ve zpr\u00e1v\u00e1ch. Na obr\u00e1zku n\u00ed\u017ee je uveden p\u0159\u00edklad vestav\u011bn\u00e9 zpr\u00e1vy Threat Prevention.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Dashboards (View) v SmartView umo\u017e\u0148uj\u00ed spr\u00e1vci p\u0159\u00edstup k protokol\u016fm k p\u0159\u00edslu\u0161n\u00e9mu ud\u00e1losti \u2014 sta\u010d\u00ed dvakr\u00e1t kliknout na zaj\u00edmav\u00fd objekt, a\u0165 u\u017e je to sloupec diagramu nebo n\u00e1zev \u0161kodliv\u00e9ho souboru. Stejn\u011b jako v p\u0159\u00edpad\u011b zpr\u00e1v m\u016f\u017eete vytv\u00e1\u0159et vlastn\u00ed dashboardy a skr\u00fdvat u\u017eivatelsk\u00e1 data. Pro dashboardy je tak\u00e9 podporov\u00e1n import\/export \u0161ablon, pravideln\u00fd export do PDF\/Excel na e-mail spr\u00e1vce a automatick\u00e9 aktualizace dat pro sledov\u00e1n\u00ed bezpe\u010dnostn\u00edch ud\u00e1lost\u00ed v re\u00e1ln\u00e9m \u010dase.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Dal\u0161\u00ed sekce monitorov\u00e1n\u00ed<\/h2>\n

\nPopis prost\u0159edk\u016f monitorov\u00e1n\u00ed v Management Platform bude ne\u00fapln\u00fd bez zm\u00ednky o sekc\u00edch Overview, Computer Management, Endpoint Settings a Push Operations. Tyto sekce byly podrobn\u011b pops\u00e1ny ve druh\u00e9m \u010dl\u00e1nku<\/a><\/noindex>, nicm\u00e9n\u011b u\u017eite\u010dn\u00e9 bude prozkoumat jejich mo\u017enosti pro monitoring. Za\u010dn\u011bme s Overview, kter\u00e9 se skl\u00e1d\u00e1 ze dvou podsekc\u00ed \u2014 Operational Overview a Security Overview, kter\u00e9 p\u0159edstavuj\u00ed dashboardy s informacemi o stavu chr\u00e1n\u011bn\u00fdch u\u017eivatelsk\u00fdch stroj\u016f a bezpe\u010dnostn\u00edch ud\u00e1lostech. Stejn\u011b jako p\u0159i interakci s jak\u00fdmkoli jin\u00fdm dashboardem, podsekce Operational Overview a Security Overview umo\u017e\u0148uj\u00ed p\u0159i dvojit\u00e9m kliknut\u00ed na zaj\u00edmav\u00fd parametr vstoupit do sekce Computer Management s vybran\u00fdm filtrem (nap\u0159\u00edklad \u201eDesktops\u201c nebo \u201ePre-Boot Status: Enabled\u201c), nebo do sekce Logs podle konkr\u00e9tn\u00ed ud\u00e1losti. Podsekce Security Overview p\u0159edstavuje dashboard \u201eCyber Attack View \u2013 Endpoint\u201c, kter\u00fd lze nastavit \u201epodle sebe\u201c a nastavit automatick\u00e9 aktualizace dat.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Z sekce Computer Management lze sledovat stav agenta na u\u017eivatelsk\u00fdch stroj\u00edch, stav aktualizace datab\u00e1ze Anti-Malware, f\u00e1ze \u0161ifrov\u00e1n\u00ed disku a mnoho dal\u0161\u00edho. V\u0161echna data se automaticky aktualizuj\u00ed a pro ka\u017ed\u00fd z filtr\u016f se zobrazuje procentu\u00e1ln\u00ed ukazatel odpov\u00eddaj\u00edc\u00edch u\u017eivatelsk\u00fdch stroj\u016f. Tak\u00e9 je podporov\u00e1n export dat o po\u010d\u00edta\u010d\u00edch ve form\u00e1tu CSV.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

D\u016fle\u017eit\u00fdm aspektem monitorov\u00e1n\u00ed zabezpe\u010den\u00ed pracovn\u00edch stanic je nastaven\u00ed upozorn\u011bn\u00ed na kritick\u00e9 ud\u00e1losti (Alerts) a export log\u016f (Export Events) pro uchov\u00e1n\u00ed na logov\u00e9m serveru spole\u010dnosti. Ob\u011b nastaven\u00ed se prov\u00e1d\u011bj\u00ed v sekci Endpoint Settings, a pro Upozorn\u011bn\u00ed<\/i> existuje mo\u017enost p\u0159ipojit po\u0161tovn\u00ed server pro zas\u00edl\u00e1n\u00ed upozorn\u011bn\u00ed o ud\u00e1lostech administr\u00e1torovi a nakonfigurovat prahov\u00e9 hodnoty spou\u0161t\u011bn\u00ed\/vyp\u00edn\u00e1n\u00ed upozorn\u011bn\u00ed v z\u00e1vislosti na procentu\/po\u010dtu za\u0159\u00edzen\u00ed spl\u0148uj\u00edc\u00edch krit\u00e9ria ud\u00e1losti. Export ud\u00e1lost\u00ed<\/i> umo\u017e\u0148uje nastavit p\u0159esm\u011brov\u00e1n\u00ed log\u016f z Management Platform na log server spole\u010dnosti pro dal\u0161\u00ed zpracov\u00e1n\u00ed. Podporov\u00e1ny jsou form\u00e1ty SYSLOG, CEF, LEEF, SPLUNK, protokoly TCP\/UDP, jak\u00e9koli SIEM syst\u00e9my s funk\u010dn\u00edm syslog agentem, pou\u017eit\u00ed \u0161ifrov\u00e1n\u00ed TLS\/SSL a autentizaci syslog klienta.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Pro hloubkovou anal\u00fdzu ud\u00e1lost\u00ed na agentovi nebo v p\u0159\u00edpad\u011b kontaktu s technickou podporou lze rychle shrom\u00e1\u017edit logy z klienta SandBlast Agent pomoc\u00ed vynucen\u00e9 akce v sekci Push Operations. Lze nastavit p\u0159esm\u011brov\u00e1n\u00ed vytvo\u0159en\u00e9ho archivu s logy na servery Check Point nebo na podnikov\u00e9 servery, tak\u00e9 archiv s logy se ukl\u00e1d\u00e1 na u\u017eivatelsk\u00e9 za\u0159\u00edzen\u00ed v adres\u00e1\u0159i C:UsersusernameCPInfo. Podporov\u00e1no je zah\u00e1jen\u00ed procesu sb\u011bru log\u016f ve stanoven\u00e9m \u010dase a mo\u017enost odlo\u017een\u00ed operace u\u017eivatelem.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Threat Hunting<\/h2>\n

\nMetoda Threat Hunting se pou\u017e\u00edv\u00e1 k proaktivn\u00edmu vyhled\u00e1v\u00e1n\u00ed zlovoln\u00fdch \u010dinnost\u00ed a anom\u00e1ln\u00edho chov\u00e1n\u00ed v syst\u00e9mu pro dal\u0161\u00ed vy\u0161et\u0159ov\u00e1n\u00ed potenci\u00e1ln\u00edch bezpe\u010dnostn\u00edch ud\u00e1lost\u00ed. Sekce Threat Hunting v Management Platform umo\u017e\u0148uje vyhled\u00e1vat ud\u00e1losti s ur\u010den\u00fdmi parametry v datech u\u017eivatelsk\u00e9ho za\u0159\u00edzen\u00ed.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

N\u00e1stroj Threat Hunting m\u00e1 n\u011bkolik p\u0159ednastaven\u00fdch dotaz\u016f, nap\u0159\u00edklad: pro klasifikaci zlovoln\u00fdch dom\u00e9n nebo soubor\u016f, sledov\u00e1n\u00ed vz\u00e1cn\u00fdch p\u0159\u00edstup\u016f k n\u011bkter\u00fdm IP adres\u00e1m (ve srovn\u00e1n\u00ed s celkovou statistikou). Struktura dotazu se skl\u00e1d\u00e1 ze t\u0159\u00ed parametr\u016f: indik\u00e1tor<\/i> (s\u00ed\u0165ov\u00fd protokol, identifik\u00e1tor procesu, typ souboru atd.), oper\u00e1tor<\/i> (\u201eje\u201c, \u201enen\u00ed\u201c, \u201eobsahuje\u201c, \u201ejeden z\u201c atd.) a t\u011blo dotazu<\/i>. V t\u011ble dotazu lze pou\u017e\u00edt regul\u00e1rn\u00ed v\u00fdrazy, podporuje se pou\u017eit\u00ed n\u011bkolika filtr\u016f sou\u010dasn\u011b v \u0159\u00e1dku vyhled\u00e1v\u00e1n\u00ed.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Po v\u00fdb\u011bru filtru a dokon\u010den\u00ed zpracov\u00e1n\u00ed \u017e\u00e1dosti se zobraz\u00ed v\u0161echny vhodn\u00e9 ud\u00e1losti, s mo\u017enost\u00ed zobrazit podrobnosti o ud\u00e1losti, um\u00edstit objekt \u017e\u00e1dosti do karant\u00e9ny nebo vygenerovat podrobnou zpr\u00e1vu Forensics Report s popisem ud\u00e1losti. V t\u00e9to chv\u00edli je tento n\u00e1stroj v beta verzi a do budoucna se pl\u00e1nuje roz\u0161\u00ed\u0159en\u00ed funk\u010dnost\u00ed, nap\u0159\u00edklad p\u0159id\u00e1n\u00ed informac\u00ed o ud\u00e1losti ve form\u011b matice Mitre Att&ck.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Z\u00e1v\u011br<\/h3>\n

\nZrekapitulujeme: v tomto \u010dl\u00e1nku jsme prozkoumali mo\u017enosti sledov\u00e1n\u00ed ud\u00e1lost\u00ed bezpe\u010dnosti na platform\u011b SandBlast Agent Management, prozkoumali nov\u00fd n\u00e1stroj pro proaktivn\u00ed vyhled\u00e1v\u00e1n\u00ed \u0161kodliv\u00fdch \u010dinnost\u00ed a anom\u00e1li\u00ed na u\u017eivatelsk\u00fdch stroj\u00edch \u2013 Threat Hunting. N\u00e1sleduj\u00edc\u00ed \u010dl\u00e1nek bude z\u00e1v\u011bre\u010dn\u00fd v t\u00e9to s\u00e9rii a pod\u00edv\u00e1me se na nej\u010dast\u011bj\u0161\u00ed dotazy k \u0159e\u0161en\u00ed Management Platform a p\u0159edstav\u00edme mo\u017enosti testov\u00e1n\u00ed tohoto produktu.<\/p>\n

Velk\u00e1 sb\u00edrka materi\u00e1l\u016f o Check Point od TS Solution<\/a><\/noindex>. Abyste nezme\u0161kali dal\u0161\u00ed publikace na t\u00e9ma SandBlast Agent Management Platform \u2014 sledujte na\u0161e aktualizace na soci\u00e1ln\u00edch m\u00e9di\u00edch (Telegram<\/a><\/noindex>, Facebook<\/a><\/noindex>, VK<\/a><\/noindex>, TS Solution Blog<\/a><\/noindex>, Yandex.Zen<\/a><\/noindex>).
\n
Zdroj: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043e\u0431\u0440\u043e \u043f\u043e\u0436\u0430\u043b\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043f\u044f\u0442\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u0446\u0438\u043a\u043b\u0430 \u043e \u0440\u0435\u0448\u0435\u043d\u0438\u0438 Check Point SandBlast Agent Management Platform. \u0421 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u043c\u0438 \u0441\u0442\u0430\u0442\u044c\u044f\u043c\u0438 \u043c\u043e\u0436\u043d\u043e \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u044c\u0441\u044f, \u043f\u0435\u0440\u0435\u0439\u0434\u044f \u043f\u043e \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u0441\u0441\u044b\u043b\u043a\u0435: \u043f\u0435\u0440\u0432\u0430\u044f, \u0432\u0442\u043e\u0440\u0430\u044f, \u0442\u0440\u0435\u0442\u044c\u044f, \u0447\u0435\u0442\u0432\u0451\u0440\u0442\u0430\u044f. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0432 Management Platform, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u043b\u043e\u0433\u0430\u043c\u0438, \u0438\u043d\u0442\u0435\u0440\u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c\u0438 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u0430\u043c\u0438 (View) \u0438 \u043e\u0442\u0447\u0451\u0442\u0430\u043c\u0438. \u0422\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0435\u043c \u0442\u0435\u043c\u0443 Threat Hunting \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0433\u0440\u043e\u0437 \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":92914,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-92913","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd475. Check Point SandBlast Agent Management Platform. Protokoly, zpr\u00e1vy a forenzn\u00ed anal\u00fdzy. Threat Hunting | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd475. Check Point SandBlast Agent Management Platform. Logs, Reports & Forensics. Threat Hunting | ProHoster","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-01T11:42:56+00:00","article:modified_time":"2020-09-01T11:42:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"92913","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:58:25","updated":"2022-09-30 07:34:54","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/92913","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=92913"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/92913\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/92914"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=92913"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=92913"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=92913"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}