{"id":53297,"date":"2019-11-28T00:00:00","date_gmt":"2019-11-27T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/1-analiz-zlovredov-s-pomoshhyu-forenziki-check-point-sandblast-network"},"modified":"2020-02-18T14:01:11","modified_gmt":"2020-02-18T11:01:11","slug":"1-analiz-zlovredov-s-pomoshhyu-forenziki-check-point-sandblast-network","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/1-analiz-zlovredov-s-pomoshhyu-forenziki-check-point-sandblast-network","title":{"rendered":"1. Ohtlikkuse anal\u00fc\u00fcs Check Point forensicsiga. SandBlast Network","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"1. Ohtlikkuse anal\u00fc\u00fcs Check Point forensicsiga. SandBlast Network\" src=\"\/wp-content\/uploads\/2019\/11\/6cdc050d06c58f4213e13826d2a15c65.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTere tulemast uude artiklite ts\u00fcklisse, seekord uurimisjuhtumite teemal, nimelt \u2014 ohtlike programmide anal\u00fc\u00fcs Check Point forensicsiga. Varem oleme avaldanud <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/358508\/\">mitu videokoolitust<\/a><\/noindex> Smart Eventi kasutamise kohta, kuid seekord vaatame forensicsi aruandeid konkreetsete s\u00fcndmuste kohta erinevates Check Pointi toodetes:<\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/checkpoint\/sandblast\">SandBlast Network<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/reshenie\/sandblast-agent\">SandBlast Agent<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/reshenie\/mobile-threat-defense\">SandBlast Mobile<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.checkpoint.com\/ru\/products\/cloud-security\/\">CloudGuard SaaS<\/a><\/noindex><\/li>\n<\/ul>\n<p>\nMiks on oluline ennetatud intsidentide forensic uurimine? N\u00e4ib, et kui oled viiruse kinni p\u00fc\u00fcdnud, on juba h\u00e4sti, miks sellega tegeleda? Praktiliselt on soovitatav mitte ainult r\u00fcnnaku blokeerimine, vaid ka m\u00f5ista, kuidas see t\u00e4pselt t\u00f6\u00f6tab: mis oli sisenemispunkt, milliseid haavatavusi kasutati, millised protsessid on seotud, kas registrit ja failis\u00fcsteemi m\u00f5jutatakse, milline viiruset\u00fc\u00fcp on, milline on v\u00f5imaliku kahju ulatus jne. Need ja muud kasulikud andmed saab kokkuv\u00f5tlikes forensic aruanetes Check Point'i poolt (nii tekstilises kui ka graafilises vormis). Sellise aruande k\u00e4sitsi koostamine on v\u00e4ga keeruline. Seej\u00e4rel v\u00f5ivad need andmed aidata astuda vajalikke samme ja v\u00e4listada sarnaste r\u00fcnnakute eduka toimumise tulevikus. T\u00e4na vaatame Check Point SandBlast Network'i forensic aruannet.<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>SandBlast Network<\/h3>\n<p>\nLiivakastide kasutamine v\u00f5rgu piiri tugevdamiseks on juba ammu saanud tavaks ning on sama kohustuslik komponent kui IPS. Check Point'is vastutab liivakasti funktsionaalsuse eest Threat Emulation b\u043b\u0435\u0439d, mis kuulub SandBlast tehnoloogiate hulka (seal on ka Threat Extraction). Oleme varem juba avaldanud <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/325822\/\">v\u00e4ikese kursuse Check Point SandBlast kohta<\/a><\/noindex> veel versioonile Gaia 77.30 (soovitan v\u00e4ga vaadata, kui te ei m\u00f5ista, millest r\u00e4\u00e4gitakse). Arhitektuuri vaatepunktist pole selle ajaga p\u00f5him\u00f5tteliselt midagi muutunud. Kui teil on oma v\u00f5rgu piiril Check Point Gateway, saate kasutada kahte liidestusvarianti liivakasti jaoks:<\/p>\n<ol>\n<li><b>SandBlast Local Appliance<\/b> \u2014 teie v\u00f5rku paigaldatakse t\u00e4iendav SandBlast seade, kuhu saadetakse anal\u00fc\u00fcsimiseks failid.<\/li>\n<li><b>SandBlast Cloud<\/b> \u2014 failid saadetakse anal\u00fc\u00fcsimiseks Check Point'i pilve.<\/li>\n<\/ol>\n<p>\n<img decoding=\"async\" alt=\"1. Ohtlikkuse anal\u00fc\u00fcs Check Point forensicsiga. SandBlast Network\" src=\"\/wp-content\/uploads\/2019\/11\/6c95d4e982dae312491c23a74c2fc8c1.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nLiivakasti v\u00f5ib pidada viimaseks kaitseliiniks v\u00f5rgu piiril. See \u00fchendatakse alles p\u00e4rast anal\u00fc\u00fcsi klassikaliste vahendite \u2014 viiruset\u00f5rje, IPS \u2014 kasutamist. Kui sellised traditsioonilised signatuurip\u00f5hised vahendid ei anna praktiliselt mingit anal\u00fc\u00fcsi, suudab liivakast \u00fcksikasjalikult \"r\u00e4\u00e4kida\", miks fail blokeeriti ja mida kahjulikku see t\u00e4pselt teeb. Sellise forensiikanal\u00fc\u00fcsi raporti v\u00f5ib saada nii kohalikult kui ka pilvep\u00f5hiselt liivakastilt.<\/p>\n<h3>Check Point Forensics Report<\/h3>\n<p>\nKujutage ette, et olete k\u00fcberjulgeoleku spetsialist, kes tuli t\u00f6\u00f6le ja avas SmartConsole'i armatuurlaua. Kohe n\u00e4ete viimase 24 tunni s\u00fcndmusi ja teie t\u00e4helepanu k\u00f6idab Threat Emulation'i s\u00fcndmused \u2014 k\u00f5ige ohtlikumad r\u00fcnnakud, mida ei ole blokeeritud signatuurianal\u00fc\u00fcsiga.<\/p>\n<p><img decoding=\"async\" alt=\"1. Ohtlikkuse anal\u00fc\u00fcs Check Point forensicsiga. SandBlast Network\" src=\"\/wp-content\/uploads\/2019\/11\/0510430e48fe0a2a766d52fec720c47b.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSaate \u201esukelduda\u201d neisse s\u00fcndmustesse (drill down) ja vaadata k\u00f5iki Threat Emulation'i blade'i logisid.<\/p>\n<p><img decoding=\"async\" alt=\"1. Ohtlikkuse anal\u00fc\u00fcs Check Point forensicsiga. SandBlast Network\" src=\"\/wp-content\/uploads\/2019\/11\/e0f2eef5df971696c2b8fbc521f82094.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00e4rast seda saate logisid lisaks filtreerida ohu t\u00f5siduse (Severity) ja Confidence Level'i (t\u00f5hususe tase) j\u00e4rgi:<\/p>\n<p><img decoding=\"async\" alt=\"1. Ohtlikkuse anal\u00fc\u00fcs Check Point forensicsiga. SandBlast Network\" src=\"\/wp-content\/uploads\/2019\/11\/27e224aeebdd34a8e1ee00b9da492180.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAvades huvipakkuva s\u00fcndmuse, saate tutvuda \u00fcldteabega (src, dst, severity, sender jne):<\/p>\n<p><img decoding=\"async\" alt=\"1. Ohtlikkuse anal\u00fc\u00fcs Check Point forensicsiga. SandBlast Network\" src=\"\/wp-content\/uploads\/2019\/11\/a7add16c7ce9fe7336d469574e339964.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJa seal v\u00f5ite m\u00e4rgata jaotist <b>Forensics<\/b> koos saadaval olevaga <b>Summary<\/b> aruande. Kl\u00f5psates sellel avaneb meile \u00fcksikasjalik anal\u00fc\u00fcs pahavarast interaktiivse HTML-lehek\u00fcljena:<\/p>\n<p><img decoding=\"async\" alt=\"1. Ohtlikkuse anal\u00fc\u00fcs Check Point forensicsiga. SandBlast Network\" src=\"\/wp-content\/uploads\/2019\/11\/1b5619fc6824b3695aacbbeaa277e622.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n(See on osa lehelt. <noindex><a rel=\"nofollow\" href=\"https:\/\/eolkov.github.io\/checkpoint-forensics\/\">Originaali saab vaadata siit<\/a><\/noindex>)<\/p>\n<p>Sellelt aruandele saame alla laadida pahavara originaali (parooliga kaitstud arhiivis) v\u00f5i kohe kontakteeruda Check Pointi reageerimismeeskonnaga.<\/p>\n<p><img decoding=\"async\" alt=\"1. Ohtlikkuse anal\u00fc\u00fcs Check Point forensicsiga. SandBlast Network\" src=\"\/wp-content\/uploads\/2019\/11\/8769a6424bda34fd37117227d8d91933.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAllpool on kena animatsioon, mis protsentuaalselt n\u00e4itab, millise juba tuntud pahavara koodiga meie eksemplar sarnaneb (sealhulgas kood ja makrod). See anal\u00fc\u00fcs on saadud Check Point Threat Cloud'i pilves toimuva masin\u00f5ppe abil.<\/p>\n<p><img decoding=\"async\" alt=\"1. Ohtlikkuse anal\u00fc\u00fcs Check Point forensicsiga. SandBlast Network\" src=\"\/wp-content\/uploads\/2019\/11\/93cdd13ab6ff751cbd04dcf0c5a4eec9.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSeej\u00e4rel saab vaadata, millised tegevused liivakastis v\u00f5imaldasid teha j\u00e4reldusi faili kuritarvitamise kohta. Antud juhul n\u00e4eme v\u00e4ltetehnikate kasutamist ja kr\u00fcpteerijate laadimist:<\/p>\n<p><img decoding=\"async\" alt=\"1. Ohtlikkuse anal\u00fc\u00fcs Check Point forensicsiga. SandBlast Network\" src=\"\/wp-content\/uploads\/2019\/11\/1f09eec9a452bbc3bdb5d79321984767.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV\u00f5ime m\u00e4rgata, et sel juhul emuleeriti kahte s\u00fcsteemi (Win 7, Win XP) ning erinevaid tarkvara versioone (Office, Adobe). Allpool on video (slideshow) selle faili avamisprotsessist liivakastis:<\/p>\n<p><img decoding=\"async\" alt=\"1. Ohtlikkuse anal\u00fc\u00fcs Check Point forensicsiga. SandBlast Network\" src=\"\/wp-content\/uploads\/2019\/11\/1691a0182ae9e24f299b285ddd189614.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVideo n\u00e4ide:<\/p>\n<p><img decoding=\"async\" alt=\"1. Ohtlikkuse anal\u00fc\u00fcs Check Point forensicsiga. SandBlast Network\" src=\"\/wp-content\/uploads\/2019\/11\/4592c38017531a8a376c065c9a88ad3e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nL\u00f5pus saame \u00fcksikasjalikult j\u00e4lgida, kuidas r\u00fcnnak arenes. Kas tabelivormis v\u00f5i graafiliselt:<\/p>\n<p><img decoding=\"async\" alt=\"1. Ohtlikkuse anal\u00fc\u00fcs Check Point forensicsiga. SandBlast Network\" src=\"\/wp-content\/uploads\/2019\/11\/34ead6a4a18cf9e0fee9ef61d30aa4c3.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSeal saame ka alla laadida selle teabe RAW-formaadis ja pcap-failina, et anal\u00fc\u00fcsida Wireshark'is genereeritud liiklust:<\/p>\n<p><img decoding=\"async\" alt=\"1. Ohtlikkuse anal\u00fc\u00fcs Check Point forensicsiga. SandBlast Network\" src=\"\/wp-content\/uploads\/2019\/11\/9fdfca16b80a62288adda4f51f013be3.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Kokkuv\u00f5te<\/h3>\n<p>\nKasutades neid andmeid, on v\u00f5imalik m\u00e4rkimisv\u00e4\u00e4rselt tugevdada teie v\u00f5rgu kaitset. Blokeerida viiruste levitajad, sulgeda kasutatavad haavatavused, takistada v\u00f5imalikku tagasisidet C&amp;C ning palju muud. Selle anal\u00fc\u00fcsiga ei tohiks alahinnata.<\/p>\n<p>J\u00e4rgmistes artiklites vaatame samamoodi SandBlast Agendi, SandBlast Mobile'i ning CloudGiard SaaS-i aruandeid. Seega pidage silmas uuendusi (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/groups\/tssolution.info\/\">Facebook<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">TS Solution Blog<\/a><\/noindex>)!<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/477494\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0414\u043e\u0431\u0440\u043e \u043f\u043e\u0436\u0430\u043b\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u0446\u0438\u043a\u043b \u0441\u0442\u0430\u0442\u0435\u0439, \u043d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u043f\u043e \u0442\u0435\u043c\u0435 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u2014 \u0430\u043d\u0430\u043b\u0438\u0437\u0443 \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u043e\u0432 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0444\u043e\u0440\u0435\u043d\u0437\u0438\u043a\u0438 Check Point. \u0420\u0430\u043d\u0435\u0435 \u043c\u044b \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0432\u0438\u0434\u0435\u043e \u0443\u0440\u043e\u043a\u043e\u0432 \u043f\u043e \u0440\u0430\u0431\u043e\u0442\u0435 \u0432 Smart Event, \u043d\u043e \u043d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u043e\u0442\u0447\u0435\u0442\u044b \u0444\u043e\u0440\u0435\u043d\u0437\u0438\u043a\u0438 \u043f\u043e \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u043c \u0441\u043e\u0431\u044b\u0442\u0438\u044f\u043c \u0432 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Check Point: SandBlast Network SandBlast Agent SandBlast [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-53297","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0414\u043e\u0431\u0440\u043e \u043f\u043e\u0436\u0430\u043b\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u0446\u0438\u043a\u043b \u0441\u0442\u0430\u0442\u0435\u0439, \u043d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u043f\u043e \u0442\u0435\u043c\u0435 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u2014 \u0430\u043d\u0430\u043b\u0438\u0437\u0443 \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u043e\u0432 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0444\u043e\u0440\u0435\u043d\u0437\u0438\u043a\u0438 Check Point. \u0420\u0430\u043d\u0435\u0435 \u043c\u044b \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0432\u0438\u0434\u0435\u043e \u0443\u0440\u043e\u043a\u043e\u0432 \u043f\u043e \u0440\u0430\u0431\u043e\u0442\u0435 \u0432 Smart Event, \u043d\u043e \u043d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u043e\u0442\u0447\u0435\u0442\u044b \u0444\u043e\u0440\u0435\u043d\u0437\u0438\u043a\u0438 \u043f\u043e \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u043c \u0441\u043e\u0431\u044b\u0442\u0438\u044f\u043c \u0432 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Check Point: SandBlast Network SandBlast Agent SandBlast\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/1-analiz-zlovredov-s-pomoshhyu-forenziki-check-point-sandblast-network\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd471. \u0410\u043d\u0430\u043b\u0438\u0437 \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u043e\u0432 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0444\u043e\u0440\u0435\u043d\u0437\u0438\u043a\u0438 Check Point. SandBlast Network | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0414\u043e\u0431\u0440\u043e \u043f\u043e\u0436\u0430\u043b\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u0446\u0438\u043a\u043b \u0441\u0442\u0430\u0442\u0435\u0439, \u043d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u043f\u043e \u0442\u0435\u043c\u0435 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u2014 \u0430\u043d\u0430\u043b\u0438\u0437\u0443 \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u043e\u0432 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0444\u043e\u0440\u0435\u043d\u0437\u0438\u043a\u0438 Check Point. \u0420\u0430\u043d\u0435\u0435 \u043c\u044b \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0432\u0438\u0434\u0435\u043e \u0443\u0440\u043e\u043a\u043e\u0432 \u043f\u043e \u0440\u0430\u0431\u043e\u0442\u0435 \u0432 Smart Event, \u043d\u043e \u043d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u043e\u0442\u0447\u0435\u0442\u044b \u0444\u043e\u0440\u0435\u043d\u0437\u0438\u043a\u0438 \u043f\u043e \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u043c \u0441\u043e\u0431\u044b\u0442\u0438\u044f\u043c \u0432 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Check Point: SandBlast Network SandBlast Agent SandBlast\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/1-analiz-zlovredov-s-pomoshhyu-forenziki-check-point-sandblast-network\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-11-27T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:01:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd471. Pahavara anal\u00fc\u00fcs Check Point'i forensiika abil. SandBlast Network | ProHoster","description":"Tere tulemast uude artiklite ts\u00fckli, seekord s\u00fcndmuste uurimise teemal, nimelt - pahavara anal\u00fc\u00fcs Check Point'i forensiika abil. Oleme varem avaldanud mitu videotundi Smart Event'i kasutamisest, kuid seekord vaatame forensiika aruandeid, mis k\u00e4sitlevad konkreetseid s\u00fcndmusi erinevates Check Point'i toodetes: SandBlast Network, SandBlast Agent, SandBlast.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/1-analiz-zlovredov-s-pomoshhyu-forenziki-check-point-sandblast-network","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd471. \u0410\u043d\u0430\u043b\u0438\u0437 \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u043e\u0432 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0444\u043e\u0440\u0435\u043d\u0437\u0438\u043a\u0438 Check Point. SandBlast Network | ProHoster","og:description":"\u0414\u043e\u0431\u0440\u043e \u043f\u043e\u0436\u0430\u043b\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u0446\u0438\u043a\u043b \u0441\u0442\u0430\u0442\u0435\u0439, \u043d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u043f\u043e \u0442\u0435\u043c\u0435 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u2014 \u0430\u043d\u0430\u043b\u0438\u0437\u0443 \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u043e\u0432 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0444\u043e\u0440\u0435\u043d\u0437\u0438\u043a\u0438 Check Point. \u0420\u0430\u043d\u0435\u0435 \u043c\u044b \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0432\u0438\u0434\u0435\u043e \u0443\u0440\u043e\u043a\u043e\u0432 \u043f\u043e \u0440\u0430\u0431\u043e\u0442\u0435 \u0432 Smart Event, \u043d\u043e \u043d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u043e\u0442\u0447\u0435\u0442\u044b \u0444\u043e\u0440\u0435\u043d\u0437\u0438\u043a\u0438 \u043f\u043e \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u043c \u0441\u043e\u0431\u044b\u0442\u0438\u044f\u043c \u0432 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Check Point: SandBlast Network SandBlast Agent SandBlast","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/1-analiz-zlovredov-s-pomoshhyu-forenziki-check-point-sandblast-network","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-27T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53297","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 06:50:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:27:39","updated":"2026-01-24 06:50:20"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/53297","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=53297"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/53297\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=53297"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=53297"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=53297"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}