{"id":92913,"date":"2020-09-01T13:42:56","date_gmt":"2020-09-01T11:42:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting"},"modified":"2020-09-01T13:42:56","modified_gmt":"2020-09-01T11:42:56","slug":"5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","title":{"rendered":"5. Check Point SandBlast Agent Management Platform. Logid, Aruanded &amp; Forensiika. Ohuhaldus","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logid, Aruanded &amp; Kriminaalhooldus. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/a7187930f8cd3b00abd80e0f8d9f0324.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTere tulemast Check Point SandBlast Agent Management Platformi lahenduste viienda artikli juurde. Eelmiste artiklitega saate tutvuda vastava lingi kaudu: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/511768\/\">esimene<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/512614\/\">teine<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/513254\/\">kolmas<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/515172\/\">neljas<\/a><\/noindex>T\u00e4na vaatame \u00fcle Management Platformi j\u00e4lgimisv\u00f5imekuse, eelk\u00f5ige logide, interaktiivsete armatuurlaudade (View) ja raportite t\u00f6\u00f6tlemise. Samuti k\u00e4sitleme Threat Hunting\u2019i teemat, et tuvastada aktuaalseid ohte ja ebanormaalseid s\u00fcndmusi kasutaja masinas.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Logs<\/h2>\n<p>\nPeamine teabeallikas turvas\u00fcndmuste j\u00e4lgimiseks on Logs jaotus, mis n\u00e4itab igasuguste intsidentide kohta \u00fcksikasjalikku teavet ning v\u00f5imaldab kasutada mugavaid filtreid otsingukriteeriumide t\u00e4psustamiseks. N\u00e4iteks, kui klikite seadistusel (Blade, Action, Severity jne) huvipakkuvale logile, saab selle m\u00e4\u00e4ra filtreerida kui <i>Filter: \u00abParameter\u00bb<\/i> v\u00f5i <i>Filter Out: \u00abParameter\u00bb<\/i>. Samuti saab Source parameetrile valida IP Tools valiku, mille abil saab k\u00e4ivitada ping j\u00e4rgnevale IP-aadressile\/nimele v\u00f5i teha nslookup p\u00e4ringu, et saada IP-aadress allikast nime j\u00e4rgi.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/er\/gj\/-r\/ergj-rhqeb5doaruijchefsbbmc.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logid, Aruanded &amp; Kriminaalhooldus. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/b38e68cc93766b19f412e89fd4e851f3.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Logs jaotises on s\u00fcndmuste filtreerimiseks alamjaotis Statistics, kus kuvatakse statistika k\u00f5ikide parameetrite kohta: ajagraafik logide arvu kohta ning protsentuaalsed n\u00e4itajad iga parameetri kohta. Sellel alamjaotuselt on lihtne filterdada logisid ilma otsinguriba ja filtreerimiseavaldiste kirjutamiseta \u2014 piisab, kui valida huvipakkuvad parameetrid, ja uus logide nimekiri kuvatakse kohe.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/sm\/gm\/mf\/smgmmffyujvi1crg45z5uitlvwa.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logid, Aruanded &amp; Kriminaalhooldus. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/10deab53312dbef413e58f7edb5f43f0.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Iga teave iga logi kohta on saadaval sektsiooni Logs paremas paneelis, kuid mugavam on logi avada topeltkl\u00f5psuga, et anal\u00fc\u00fcsida sisu. Allpool on n\u00e4ide logist (pilt on klikitav), kus kuvatakse \u00fcksikasjalik teave Threat Emulation bloki ennetamise tegevuse toime kohta nakatunud faili \" .docx \". Logil on mitu alamsectioni, mis kuvavad turvas\u00fcndmuse \u00fcksikasju: rakendatud poliitika ja kaitse, kriminaalsete uuringute \u00fcksikasjad, kliendi ja liikluse teave. Eriti t\u00e4helepanuv\u00e4\u00e4rsed on logist saadavad aruanded - Threat Emulation Report ja Forensics Report. Need aruanded on samuti saadaval SandBlast Agenti kliendist.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/u5\/ch\/e1\/u5che1n2ww-hycuu8j1-55cadfi.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logid, Aruanded &amp; Kriminaalhooldus. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/2e3650320a5e06a7c0503433ac4ad541.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h3>Threat Emulation Report<\/h3>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/ns\/h4\/_k\/nsh4_knfdmptu_-nfd97_pemoim.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logid, Aruanded &amp; Kriminaalhooldus. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/b0d753ec281f8409fe02946f9a3680b3.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Threat Emulation'i blade'i kasutades ilmub Check Pointi pilves emuleerimise sooritamisel vastavas logis link \u00fcksikasjaliku emuleerimise tulemuste aruande \u2014 Threat Emulation Report. Sellise aruande sisu on detailselt kirjeldatud meie artiklis <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/477494\/\">Check Point SandBlast Networki forenzika abil pahavara anal\u00fc\u00fcsi kohta<\/a><\/noindex>. Tuleb m\u00e4rkida, et see aruanne on interaktiivne ja v\u00f5imaldab \"sukelduda\" \u00fcksikasjadesse iga jao kohta. Samuti on v\u00f5imalik vaadata emuleerimise protsessi salvestust virtuaalses masinas, alla laadida originaal pahavara fail v\u00f5i saada selle hash, samuti p\u00f6\u00f6rduda Check Pointi Incidendi Vastamise Meeskonna poole.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/8a\/lh\/xx\/8alhxxvnjs1ewg8b4_2vb9w1464.gif\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logid, Aruanded &amp; Kriminaalhooldus. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/9048cf717e020ae6d5bf2c106397bfe3.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h3>Forensics Report<\/h3>\n<p>\nPeaaegu iga turvaseisundi puhul genereeritakse Forensics Report, mis sisaldab \u00fcksikasjalikku teavet pahavarafaili kohta: selle omadused, tegevused, s\u00fcsteemi sisenemise punkt ja m\u00f5ju ettev\u00f5tte olulistele varadele. Aruande struktuuri on meeles peetud meie artiklis <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/478396\/\">Check Point SandBlast Agenti forenzika abil pahavara anal\u00fc\u00fcsi kohta<\/a><\/noindex>. Selline aruanne on oluline teabeallikas turvas\u00fcndmuste uurimisel ning vajadusel saab selle sisu kohe edastada Check Pointi h\u00e4daolukordade reageerimise meeskonnale.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/wh\/qb\/pe\/whqbpe7hlwwujwxdv4um42eb-no.gif\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logid, Aruanded &amp; Kriminaalhooldus. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/7010f25765e6c3bfb6dff40a8cf48e24.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h2>SmartView<\/h2>\n<p>\nCheck Point SmartView on mugav t\u00f6\u00f6riist d\u00fcnaamiliste armatuurlaudade (View) ja PDF-formaadis aruannete koostamiseks ja vaatamiseks. SmartView'ist on v\u00f5imalik vaadata ka kasutaja logisid ja auditifunktsioonide s\u00fcndmusi administraatoritele. Alloleval joonisel on esitatud k\u00f5ige kasulikumaid aruandeid ja armatuurlaudu SandBlast Agente k\u00e4sitledes.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/wr\/e5\/yo\/wre5yoe7iptzwak-7vgbmszpzky.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logid, Aruanded &amp; Kriminaalhooldus. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/62a262c57811eede4609637590481ef0.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>SmartView'i aruanded on dokumendid, mis sisaldavad statistilist teavet s\u00fcndmuste kohta teatud ajavahemikus. Toetatakse aruannete allalaadimist PDF-formaadis masinale, kus SmartView on avatud, samuti regulaarset PDF\/Excel allalaadimist administraatori e-posti aadressile. Lisaks toetatakse aruannete mallide importimist ja eksportimist, enda aruannete loomist ning kasutajanimede peitmist aruannetes. Alloleval joonisel on esitatud n\u00e4ide sisseehitatud aruandest Threat Prevention.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/c2\/ol\/br\/c2olbrgf6jufazr6w6wzhi7rxgg.gif\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logid, Aruanded &amp; Kriminaalhooldus. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/293e7d94792e09eefe93981369af817b.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>SmartView'i dashingid (View) v\u00f5imaldavad adminil ligip\u00e4\u00e4su logidele, mis seonduvad vastava s\u00fcndmusega \u2014 piisab vaid kahel korral huvipakkuvale objektile vajutamisest, olgu selleks siis diagrammi veerg v\u00f5i pahatahtliku faili nimi. Nagu raportite puhul, saab luua ka enda dashingid ning varjata kasutajate andmeid. Dashingite jaoks on toetatud ka mallide importimine\/eksportimine, regulaarne v\u00e4ljund PDF\/Excel formaadis administraatori e-posti ja andmete automaatne v\u00e4rskendamine reaalaja turvahoidlate j\u00e4lgimiseks.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/md\/ob\/l3\/mdobl3ed5laokqioysiwzs6h3yi.gif\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logid, Aruanded &amp; Kriminaalhooldus. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/efd3584fdb1e1d61109e55a4137c8e0d.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h2>Lisamonitorimise jaotised<\/h2>\n<p>\nManagement Platformi j\u00e4lgimisvahendite kirjeldus ei oleks t\u00e4ielik ilma jaotiste Overview, Computer Management, Endpoint Settings ja Push Operations mainimiseta. Need jaotised on p\u00f5hjalikult kirjeldatud. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/512614\/\">artikliks<\/a><\/noindex>, kuid kasulik on vaadata nende v\u00f5imalusi monitooring\u00fclesannete lahendamiseks. Alustame \u00fclevaatest, mis koosneb kahest alamjaotusest \u2014 Operatiivne \u00dclevaade ja Turbe\u00fclevaade, mis on juhtpaneelid, mis sisaldavad teavet kaitstud kasutajamasinate seisundi ja turbeintsidentide kohta. Nagu ka igasuguste muude juhtpaneelide puhul, v\u00f5imaldavad Operatiivse \u00dclevaate ja Turbe\u00fclevaate alamjaotused, kui topeltkl\u00f5psata huvipakkuval parameetril, siseneda arvutihalduse sektsiooni valitud filtriga (nt \u201eT\u00f6\u00f6lauad\u201d v\u00f5i \u201eEelk\u00e4ivituse olek: Lubatud\u201d), v\u00f5i Logide sektsiooni konkreetse s\u00fcndmuse j\u00e4rgi. Turbe\u00fclevaate alamjaotus on \u201eK\u00fcberr\u00fcnnaku vaade \u2013 L\u00f5pp-punkt\u201d juhtpaneel, mida saab isikup\u00e4rastada ja seadistada automaatse andmete v\u00e4rskendamise.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/--\/bl\/sr\/--blsrbxcaapnnnckd5ov9in5rk.gif\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logid, Aruanded &amp; Kriminaalhooldus. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/4f49d2a2f33f64cf65924ff3a1140e19.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Arvutihalduse sektsioonist saab j\u00e4lgida agendi seisundit kasutajamasinates, k\u00fcberturbe andmebaasi v\u00e4rskendamise staatust, ketta kr\u00fcpteerimise etappe ja palju muud. K\u00f5ik andmed v\u00e4rskendatakse automaatselt ja iga filtri jaoks kuvatakse sobivate kasutajamasinate protsendim\u00e4\u00e4r. Samuti toetatakse arvutite andmete exportimist CSV-formaadis.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/ij\/zi\/ni\/ijzinixrgrhpci2cgi3hugndspw.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logid, Aruanded &amp; Kriminaalhooldus. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/fd99e1dbfa12324f44bd18bfd07a7632.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Oluline aspekt t\u00f6\u00f6laua turvalisuse j\u00e4lgimisel on h\u00e4daolukordade (Alerts) ja logide eksportimise (Export Events) teavituste seadistamine, et neid hoida ettev\u00f5tte logiserveris. M\u00f5lemad seaded teostatakse Endpoint Settings ja <i>Alerts<\/i> on v\u00f5imalik seadistada meiliserver teavituste saatmiseks administraatorile ning konfigureerida teavituste aktiveerimise\/deaktiveerimise l\u00e4vendid vastavalt seadmete protsendile\/arvule, mis vastavad s\u00fcndmuse kriteeriumidele. <i>Ekspordi s\u00fcndmused<\/i> v\u00f5imaldab seadistada logide edastamise Management Platformist ettev\u00f5tte logiserverisse edasiseks t\u00f6\u00f6tlemiseks. Toetatud on SYSLOG, CEF, LEEF, SPLUNK formaadid, TCP\/UDP protokollid, k\u00f5ik SIEM-s\u00fcsteemid, kus t\u00f6\u00f6tab syslog-agent, TLS\/SSL kr\u00fcpteerimise kasutamine ja syslog-klientide autentimine.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/vx\/73\/o0\/vx73o0ismioxm9l-ymvdvfkjhny.gif\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logid, Aruanded &amp; Kriminaalhooldus. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/b9af095705868c7ba9f63d4d927bdae5.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Klient SandBlast Agent'ilt saab kiiresti koguda logisid s\u00fcvitsi minevate s\u00fcndmusanal\u00fc\u00fcside jaoks v\u00f5i tehnilise toe korral. Logide genereeritud arhiivi edastamine Check Pointi serveritesse v\u00f5i ettev\u00f5tte serveritesse on v\u00f5imalik Push Operations jaotises. Logide arhiiv salvestatakse ka kasutaja arvutisse katalooge C:UsersusernameCPInfo. Logide kogumise protsessi saab k\u00e4ivitada m\u00e4\u00e4ratud ajal ning kasutajal on v\u00f5imalus operatsiooni edasi l\u00fckata.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/iy\/5u\/6o\/iy5u6ovlg4fxi-ex0whpxh4yjms.gif\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logid, Aruanded &amp; Kriminaalhooldus. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/2ef458a297b223b30813091f54195d76.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h2>Threat Hunting<\/h2>\n<p>\nThreat Hunting meetodit kasutatakse pahatahtlike tegevuste ja ebanormaalse k\u00e4itumise ennetavaks otsimiseks s\u00fcsteemis, et uurida potentsiaalseid turvas\u00fcndmusi. Management Platformi Threat Hunting jaotis v\u00f5imaldab otsida s\u00fcndmusi m\u00e4\u00e4ratud parameetrite alusel kasutaja arvuti andmetes.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/su\/2p\/l5\/su2pl5rwsc32slfnokqn_rrqtus.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logid, Aruanded &amp; Kriminaalhooldus. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/3f771fbea121a78d1d50daf42f1643cb.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Threat Hunting t\u00f6\u00f6riigil on mitu eelnevalt m\u00e4\u00e4ratletud p\u00e4ringut, n\u00e4iteks pahatahtlike domeenide v\u00f5i failide klassifitseerimiseks, haruldaste p\u00e4ringute j\u00e4lgimiseks teatud IP-aadresside osas (\u00fcldise statistika kontekstis). P\u00e4ringu struktuur koosneb kolmest parameetrist: <i>indikaator<\/i> (v\u00f5rguprotokoll, protsessi identifikaator, faili t\u00fc\u00fcp ja muud), <i>operaator<\/i> (\"on\", \"ei ole\", \"sisaldab\", \"\u00fcks\" ja muud) ning <i>p\u00e4ringu keha<\/i>. P\u00e4ringu kehas saab kasutada regulaaravaldusi, toetatakse mitme filtri samaaegset kasutamist otsingureas.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/1y\/3c\/2a\/1y3c2acosy5e22pturoe7khfchq.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logid, Aruanded &amp; Kriminaalhooldus. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/c0070db473264069eda4f07a919eaa8c.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Filtri valimise ja p\u00e4ringu t\u00f6\u00f6tlemise l\u00f5petamise j\u00e4rel avatakse juurdep\u00e4\u00e4s k\u00f5ikidele sobivatele s\u00fcndmustele, v\u00f5imalusega vaadata s\u00fcndmuse \u00fcksikasju, panna p\u00e4ringu objekt karantiini v\u00f5i genereerida detailne forensics-raport, milles on s\u00fcndmuse kirjeldus. Praegu on see t\u00f6\u00f6riist beetaversioonis ja tulevikus on plaanis laiendada v\u00f5imaluste komplekti, n\u00e4iteks lisada s\u00fcndmuste teavet Mitre Att&amp;ck'i matriitsi kujul.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/i8\/uh\/ck\/i8uhckgoeakoqcbd7nqx1btijac.png\"><img decoding=\"async\" alt=\"5. Check Point SandBlast Agent Management Platform. Logid, Aruanded &amp; Kriminaalhooldus. Threat Hunting\" src=\"\/wp-content\/uploads\/2020\/09\/61c9043715428af9cbd90bd49e679ce3.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h3>Kokkuv\u00f5te<\/h3>\n<p>\nKokkuv\u00f5tteks: selles artiklis k\u00e4sitlesime SandBlast Agent Management Platformi turvas\u00fcndmuste j\u00e4lgimise v\u00f5imalusi, tutvustasime uut t\u00f6\u00f6riista pahatahtlike tegevuste ja anomaaliate proaktiivseks otsimiseks kasutajaseadmetes \u2014 Threat Hunting. J\u00e4rgmine artikkel l\u00f5petab selle ts\u00fckli ja seal k\u00e4sitleme Management Platformi lahenduse k\u00f5ige sagedasemaid k\u00fcsimusi ning r\u00e4\u00e4gime toote testimise v\u00f5imalustest.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/358508\/\">Suur valik materjale Check Pointi kohta TS Solutionilt<\/a><\/noindex>. J\u00e4lgige meie sotsiaalmeedia profiile, et mitte maha j\u00e4\u00e4da SandBlast Agent Management Platformi teemaliste j\u00e4rgmiste v\u00e4ljaannete uudistest (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/groups\/tssolution.info\/\">Facebook<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">TS Solution Blog<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/zen.yandex.ru\/id\/5c7d2162fa818600ae386a52\">Yandex.Dzen<\/a><\/noindex>).<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/516336\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0414\u043e\u0431\u0440\u043e \u043f\u043e\u0436\u0430\u043b\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043f\u044f\u0442\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u0446\u0438\u043a\u043b\u0430 \u043e \u0440\u0435\u0448\u0435\u043d\u0438\u0438 Check Point SandBlast Agent Management Platform. \u0421 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u043c\u0438 \u0441\u0442\u0430\u0442\u044c\u044f\u043c\u0438 \u043c\u043e\u0436\u043d\u043e \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u044c\u0441\u044f, \u043f\u0435\u0440\u0435\u0439\u0434\u044f \u043f\u043e \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u0441\u0441\u044b\u043b\u043a\u0435: \u043f\u0435\u0440\u0432\u0430\u044f, \u0432\u0442\u043e\u0440\u0430\u044f, \u0442\u0440\u0435\u0442\u044c\u044f, \u0447\u0435\u0442\u0432\u0451\u0440\u0442\u0430\u044f. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0432 Management Platform, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u043b\u043e\u0433\u0430\u043c\u0438, \u0438\u043d\u0442\u0435\u0440\u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c\u0438 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u0430\u043c\u0438 (View) \u0438 \u043e\u0442\u0447\u0451\u0442\u0430\u043c\u0438. \u0422\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0435\u043c \u0442\u0435\u043c\u0443 Threat Hunting \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0433\u0440\u043e\u0437 \u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":92914,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-92913","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0414\u043e\u0431\u0440\u043e \u043f\u043e\u0436\u0430\u043b\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043f\u044f\u0442\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u0446\u0438\u043a\u043b\u0430 \u043e \u0440\u0435\u0448\u0435\u043d\u0438\u0438 Check Point SandBlast Agent Management Platform. \u0421 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u043c\u0438 \u0441\u0442\u0430\u0442\u044c\u044f\u043c\u0438 \u043c\u043e\u0436\u043d\u043e \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u044c\u0441\u044f, \u043f\u0435\u0440\u0435\u0439\u0434\u044f \u043f\u043e \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u0441\u0441\u044b\u043b\u043a\u0435: \u043f\u0435\u0440\u0432\u0430\u044f, \u0432\u0442\u043e\u0440\u0430\u044f, \u0442\u0440\u0435\u0442\u044c\u044f, \u0447\u0435\u0442\u0432\u0451\u0440\u0442\u0430\u044f. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0432 Management Platform, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u043b\u043e\u0433\u0430\u043c\u0438, \u0438\u043d\u0442\u0435\u0440\u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c\u0438 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u0430\u043c\u0438 (View) \u0438 \u043e\u0442\u0447\u0451\u0442\u0430\u043c\u0438. \u0422\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0435\u043c \u0442\u0435\u043c\u0443 Threat Hunting \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0433\u0440\u043e\u0437 \u0438\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd475. Check Point SandBlast Agent Management Platform. Logs, Reports &amp; Forensics. Threat Hunting | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0414\u043e\u0431\u0440\u043e \u043f\u043e\u0436\u0430\u043b\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043f\u044f\u0442\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u0446\u0438\u043a\u043b\u0430 \u043e \u0440\u0435\u0448\u0435\u043d\u0438\u0438 Check Point SandBlast Agent Management Platform. \u0421 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u043c\u0438 \u0441\u0442\u0430\u0442\u044c\u044f\u043c\u0438 \u043c\u043e\u0436\u043d\u043e \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u044c\u0441\u044f, \u043f\u0435\u0440\u0435\u0439\u0434\u044f \u043f\u043e \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u0441\u0441\u044b\u043b\u043a\u0435: \u043f\u0435\u0440\u0432\u0430\u044f, \u0432\u0442\u043e\u0440\u0430\u044f, \u0442\u0440\u0435\u0442\u044c\u044f, \u0447\u0435\u0442\u0432\u0451\u0440\u0442\u0430\u044f. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0432 Management Platform, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u043b\u043e\u0433\u0430\u043c\u0438, \u0438\u043d\u0442\u0435\u0440\u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c\u0438 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u0430\u043c\u0438 (View) \u0438 \u043e\u0442\u0447\u0451\u0442\u0430\u043c\u0438. \u0422\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0435\u043c \u0442\u0435\u043c\u0443 Threat Hunting \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0433\u0440\u043e\u0437 \u0438\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-09-01T11:42:56+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-09-01T11:42:56+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd475. Check Point SandBlast Agent Management Platform. Logid, Aruanded &amp; Kriminaalhooldus. Threat Hunting | ProHoster","description":"Tere tulemast Check Point SandBlast Agent Management Platformi lahenduse viienda artikli juurde. Eelnevate artiklitega tutvumiseks minge vastava lingi kaudu: esimene, teine, kolmas, neljas. T\u00e4na k\u00e4sitleme Management Platformi j\u00e4lgimisv\u00f5imalusi, peamiselt logide, interaktiivsete armatuurlauade (View) ja aruannete t\u00f6\u00f6tlemist. Samuti puudutame Threat Hunting teemat, et tuvastada praeguseid ohte ja","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd475. Check Point SandBlast Agent Management Platform. Logs, Reports &amp; Forensics. Threat Hunting | ProHoster","og:description":"\u0414\u043e\u0431\u0440\u043e \u043f\u043e\u0436\u0430\u043b\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043f\u044f\u0442\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u0446\u0438\u043a\u043b\u0430 \u043e \u0440\u0435\u0448\u0435\u043d\u0438\u0438 Check Point SandBlast Agent Management Platform. \u0421 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u043c\u0438 \u0441\u0442\u0430\u0442\u044c\u044f\u043c\u0438 \u043c\u043e\u0436\u043d\u043e \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u044c\u0441\u044f, \u043f\u0435\u0440\u0435\u0439\u0434\u044f \u043f\u043e \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u0441\u0441\u044b\u043b\u043a\u0435: \u043f\u0435\u0440\u0432\u0430\u044f, \u0432\u0442\u043e\u0440\u0430\u044f, \u0442\u0440\u0435\u0442\u044c\u044f, \u0447\u0435\u0442\u0432\u0451\u0440\u0442\u0430\u044f. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0432 Management Platform, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u043b\u043e\u0433\u0430\u043c\u0438, \u0438\u043d\u0442\u0435\u0440\u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c\u0438 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u0430\u043c\u0438 (View) \u0438 \u043e\u0442\u0447\u0451\u0442\u0430\u043c\u0438. \u0422\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0435\u043c \u0442\u0435\u043c\u0443 Threat Hunting \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0433\u0440\u043e\u0437 \u0438","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-01T11:42:56+00:00","article:modified_time":"2020-09-01T11:42:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"92913","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:58:25","updated":"2022-09-30 07:34:54"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/92913","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=92913"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/92913\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/92914"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=92913"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=92913"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=92913"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}