{"id":92913,"date":"2020-09-01T13:42:56","date_gmt":"2020-09-01T11:42:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting"},"modified":"2020-09-01T13:42:56","modified_gmt":"2020-09-01T11:42:56","slug":"5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","title":{"rendered":"5. Check Point SandBlast Agent Management Platform. Logid, aruanded & kohtuekspertiis. Ohtude jahtimine","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"5.
\n
\nTere tulemast viienda artikli juurde Check Point SandBlast Agent Management Platformi lahenduste ts\u00fcklis. Eelmistele artiklitele p\u00e4\u00e4seb, kl\u00f5psates vastavatel linkidel: esmalt<\/a><\/noindex>, teine<\/a><\/noindex>, kolmas<\/a><\/noindex>, neljas<\/a><\/noindex>. T\u00e4na vaatleme Management Platformi j\u00e4lgimisv\u00f5imalusi, sealhulgas logide, interaktiivsete juhtpaneelide (View) ja aruannete k\u00e4sitlemist. R\u00e4\u00e4gime ka Threat Hunting'ist, et tuvastada praeguseid ohte ja ebanormaalseid s\u00fcndmusi kasutaja masinas.
\n<\/a><\/noindex><\/p>\n

koormustestimise protsessis:<\/h2>\n

\nPeamine teabeallikas turvas\u00fcndmuste j\u00e4lgimiseks on Logs jaotis, mis kuvab iga intsidenti puudutavad \u00fcksikasjad ja v\u00f5imaldab kasutada mugavaid filtreid otsingukriteeriumide t\u00e4psustamiseks. N\u00e4iteks saab hiire parema nupuga kl\u00f5psates huvipakkuvale logi parameetrile (Blade, Action, Severity jne) rakendada filtrit nagu Filter: \u00abParameter\u00bb<\/i> v\u00f5i Filter Out: \u00abParameter\u00bb<\/i>. Samuti saab parameetrite all Source valida IP Tools v\u00f5imaluse, mis v\u00f5imaldab k\u00e4ivitada ping antud IP-aadressile\/nimele v\u00f5i teha nslookup, et saada IP-aadress nime alusel.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Logs jaotises on s\u00fcndmuste filtreerimiseks alamjaotis Statistics, kus kuvatakse statistika k\u00f5ikide parameetrite kohta: ajagraafik logide arvuga ja protsendilised n\u00e4itajad iga parameetri osas. Sellelt alamjaotuselt saab logisid mugavalt filtreerida, ilma et peaks p\u00f6\u00f6rduma otsinguriba v\u00f5i filtriv\u00e4ljendite kirjutamise poole \u2014 piisab, kui valida huvipakkuvad parameetrid ja uus logide nimekiri kuvatakse kohe.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Iga logi kohta saab leida \u00fcksikasjalikku teavet Logs jaotise paremas paneelis, kuid mugavam on avada logi kahekordse kl\u00f5psuga sisu anal\u00fc\u00fcsimiseks. Allpool on n\u00e4ide logist (pilt on klikitav), kus on n\u00e4idatud \u00fcksikasjalikku teavet Threat Emulation bladi toimingu Prevent aktiveerimise kohta nakatunud faili \".docx\". Logil on mitu alajaotust, mis n\u00e4itavad turvae s\u00fcndmuse \u00fcksikasju: aktiveeritud poliitika ja kaitse, forensiika \u00fcksikasjad, kliendi ja liikluse teave. Eriti t\u00e4helepanuv\u00e4\u00e4rsed on logist saadaval olevad aruanded \u2014 Threat Emulation Report ja Forensics Report. Need aruanded on saadaval ka SandBlast Agenti kliendist.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Threat Emulation Report<\/h3>\n

\n\"5.<\/a><\/noindex><\/p>\n

Threat Emulatsiooni blade'i kasutamisel ilmub Cloud Check Point'i simuleerimise p\u00e4rast vastavas logis link emulatsiooni tulemuste \u00fcksikasjaliku aruande - Threat Emulation Report. Selle aruande sisu on \u00fcksikasjalikult kirjeldatud meie artiklis, mis k\u00e4sitleb kahjulike programmide anal\u00fc\u00fcsi Check Point SandBlast Networki forensika abil<\/a><\/noindex>. Tuleb m\u00e4rkida, et see aruanne on interaktiivne ja v\u00f5imaldab \u201esukelduda\u201d iga jaotise \u00fcksikasjadesse. Samuti on v\u00f5imalik vaadata emulatsiooni protsessi salvestust virtuaalses masinas, alla laadida originaalne kahjulik fail v\u00f5i saada selle hash ning p\u00f6\u00f6rduda Check Pointi juhtumite vastamise meeskonna poole.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Forensics Report<\/h3>\n

\nPeaaegu iga turva\u00fcrituse jaoks genereeritakse Forensics Report, mis sisaldab \u00fcksikasjalikku teavet kahjuliku faili kohta: selle omadused, tegevused, s\u00fcsteemi sisenemise punkt ja m\u00f5ju ettev\u00f5tte olulistele ressurssidele. Aruande struktuuri on \u00fcksikasjalikult k\u00e4sitletud meie artiklis, mis k\u00e4sitleb kahjulike programmide anal\u00fc\u00fcsi Check Point SandBlast Agenti forensika abil<\/a><\/noindex>. Sarnane aruanne on oluline teabe allikas turva\u00fcrituste uurimisel ning vajadusel saab aruande sisu kohe saata Check Pointi juhtumite vastamise meeskonnale.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

SmartView<\/h2>\n

\nCheck Point SmartView on mugav t\u00f6\u00f6riist d\u00fcnaamiliste armatuurlaudade (View) ja PDF-formaadis aruannete koostamiseks ja vaatamiseks. SmartView's saab samuti vaadata kasutaja logisid ja auditeerimise s\u00fcndmusi administraatorite jaoks. Alloleval joonisel on toodud k\u00f5ige kasulikumad aruanded ja armatuurlaudad SandBlast Agenti t\u00f6\u00f6ks.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

SmartView aruanded on dokumendid statistilise teabega s\u00fcndmuste kohta kindla ajavahemiku jooksul. Aruannete eksportimine PDF-formaadis masinasse, kus SmartView on avatud, on toetatud, samuti regulaarne eksport PDF\/Excel formaadis administraatori elektronposti. Lisaks toetatakse aruande mallide importi\/eksporti, oma aruannete loomist ja kasutajanimede peitmist aruannetes. Alloleval joonisel on toodud n\u00e4ide sisseehitatud Threat Prevention aruandest.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Dashbordi (View) SmartView's v\u00f5imaldavad administraatoril saada ligip\u00e4\u00e4su vastava s\u00fcndmuse logidele \u2014 piisab, kui kaks korda kl\u00f5psata huvipakkuval objektile, olgu selleks diagrammi veerg v\u00f5i pahavara faili nimi. Nagu raportite puhul, on ka v\u00f5imalik luua oma dashbordid ja varjata kasutajaandmeid. Dashborde toetab ka mallide importimist\/ekspordimist, regulaarset v\u00e4ljundit PDF\/Excel formaadis administraatori e-posti aadressile ja andmete automaatset v\u00e4rskendamist reaalajas turvas\u00fcndmuste j\u00e4lgimiseks.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Lisamonitorimise jaotised<\/h2>\n

\nManagement Platformi j\u00e4lgimisvahendite kirjeldus ei oleks t\u00e4iuslik ilma jaotiste Overview, Computer Management, Endpoint Settings ja Push Operations mainimiseta. Need jaotised on p\u00f5hjalikult kirjeldatud teisest artiklist<\/a><\/noindex>, kuid oleks kasulik tutvuda nende v\u00f5imalustega j\u00e4lgimis\u00fclesannete lahendamiseks. Alustame jaotisest Overview, mis koosneb kahest alajaotusest \u2014 Operational Overview ja Security Overview, mis on dashbordid teavet kaitstud kasutajamasinate ja turvas\u00fcndmuste seisundi kohta. Nagu iga teise dashbordi puhul, v\u00f5imaldavad alajaotused Operational Overview ja Security Overview kahekordse kl\u00f5psuga huvipakkuva parameetri puhul p\u00e4\u00e4seda jaotisse Computer Management valitud filtriga (n\u00e4iteks \"Desktops\" v\u00f5i \"Pre-Boot Status: Enabled\"), v\u00f5i jaotisse Logs konkreetse s\u00fcndmuse jaoks. Alajaotis Security Overview on dashbord \"Cyber Attack View \u2013 Endpoint\", mida saab kohandada \"enda vajadustele\" ja seadistada andmete automaatne v\u00e4rskendamine.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Jaotisest Computer Management saab j\u00e4lgida agendi staatust kasutajamasinates, Anti-Malware andmebaasi v\u00e4rskendamise staatust, ketta kr\u00fcpteerimise etappe ja palju muud. K\u00f5ik andmed v\u00e4rskendatakse automaatselt ning iga filtri jaoks kuvatakse sobivate kasutajamasinate protsentuaalne n\u00e4itaja. Samuti toetatakse arvutite andmete eksportimist CSV formaadis.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Oluline aspekt t\u00f6\u00f6jaamade turvalisuse j\u00e4lgimisel on kriitiliste s\u00fcndmuste teavituste (Alerts) seadistamine ja logide eksportimine (Export Events) ettev\u00f5tte logiserverisse salvestamiseks. M\u00f5lemad seadistused teostatakse jaotises Endpoint Settings ning Alerts<\/i> on olemas v\u00f5imalus \u00fchendada meiliserver s\u00fcndmuseteavituste saatmiseks administraatorile ning konfigureerida teavituste aktiveerimise\/deaktiveerimise k\u00fcnnised vastavalt seadmete protsendi\/arvu j\u00e4rgi, mis vastavad s\u00fcndmuse kriteeriumidele. Eksporti s\u00fcndmused<\/i> v\u00f5imaldab seadistada logide edastamise Management Platform'ist ettev\u00f5tte logiserverisse edasise t\u00f6\u00f6tlemise jaoks. Toetatakse formaate SYSLOG, CEF, LEEF, SPLUNK, protokolle TCP\/UDP, ning k\u00f5ik SIEM-s\u00fcsteemid, kus t\u00f6\u00f6tab syslog-agent, kasutades TLS\/SSL kr\u00fcpteerimist ja syslog-klientide autentimist.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

S\u00fcgava s\u00fcndmuste anal\u00fc\u00fcsi jaoks agenti osas v\u00f5i tehnilise toe poole p\u00f6\u00f6rdumise korral on v\u00f5imalik kiiresti koguda logisid SandBlast Agenti klientidelt, kasutades sundoperatsiooni Push Operations jaotises. On v\u00f5imalik seadistada loodud logiarhiivi edastamist Check Pointi serveritesse v\u00f5i ettev\u00f5tte serveritesse, samuti salvestatakse logiarhiiv kasutaja masinasse katalooge C:UsersusernameCPInfo. Logide kogumise protsessi saab k\u00e4ivitada m\u00e4\u00e4ratud ajal ning kasutaja saab operatsiooni edasi l\u00fckata.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Ohutuse jahtimine<\/h2>\n

\nOhutuse jahtimise meetodit kasutatakse proaktiivseks pahavarade tegevuse ja s\u00fcsteemis toimuva anomaalse k\u00e4itumise otsimiseks, et uurida v\u00f5imalikke turvauhtuseid. Ohutuse jahtimise jaotis Management Platform'is v\u00f5imaldab otsida s\u00fcndmusi teatavate parameetritega kasutaja masina andmetes.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Ohutuse jahtimise t\u00f6\u00f6riistal on mitu eelnevalt seadistatud p\u00e4ringut, n\u00e4iteks pahatahtlike domeenide v\u00f5i failide klassifitseerimiseks, haruldaste p\u00e4ringute j\u00e4lgimiseks teatud IP-aadresside suhtes (v\u00f5rreldes \u00fcldstatistikaga). P\u00e4ringu struktuur koosneb kolmest parameetrist: indikaator<\/i> (v\u00f5rguprotokoll, protsessi identifikaator, faili t\u00fc\u00fcp jne), operaatorit<\/i> (\u201eon\u201d, \u201eei ole\u201d, \u201esisaldab\u201d, \u201e\u00fcks neist\u201d jne) ja p\u00e4ringu keha<\/i>. P\u00e4ringu kehas saab kasutada regulaaravaldisi, toetatakse mitme filtri samaaegset kasutamist otsingureas.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

P\u00e4rast filtrite valimist ja p\u00e4ringu t\u00f6\u00f6tlemise l\u00f5petamist on saadaval k\u00f5ik sobivad s\u00fcndmused, v\u00f5imalusega vaadata s\u00fcndmuse \u00fcksikasju, panna p\u00e4ringu objekt karantiini v\u00f5i genereerida \u00fcksikasjalik Forensics Report s\u00fcndmuse kirjeldustega. Praegu on see t\u00f6\u00f6riist beetaversioonis ning edaspidi on plaanis laiendada selle funktsioone, n\u00e4iteks lisada s\u00fcndmuse teavet Mitre Att&ck'i matriksi kujul.<\/p>\n

\"5.<\/a><\/noindex><\/p>\n

Kokkuv\u00f5te<\/h3>\n

\nKokkuv\u00f5tteks: selles artiklis oleme uurinud SandBlast Agent Management Platform'i turvas\u00fcndmuste j\u00e4lgimise v\u00f5imalusi, tutvunud uue t\u00f6\u00f6riistaga pahatahtlike tegevuste ja k\u00f5rvalekallete proaktiivseks otsimiseks kasutajamasinatel - Threat Hunting. J\u00e4rgmine artikkel on selle ts\u00fckli viimane ning k\u00e4sitleme k\u00f5ige sagedasemaid k\u00fcsimusi seoses Management Platform'i lahendamisega ja r\u00e4\u00e4gime selle toote testimise v\u00f5imalustest.<\/p>\n

Suur kogumik materjale Check Pointi kohta TS Solutionilt<\/a><\/noindex>. Et mitte j\u00e4\u00e4da ilma SandBlast Agent Management Platform'i teemaga seotud j\u00e4rgmiste avalduste j\u00e4lgimisest - j\u00e4lgige meie sotsiaalmeedia uuendusi (Telegram<\/a><\/noindex>, Facebook<\/a><\/noindex>, VK<\/a><\/noindex>, TS Solution Blog<\/a><\/noindex>, Yandex.Zen<\/a><\/noindex>).
\n
Allikas: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043e\u0431\u0440\u043e \u043f\u043e\u0436\u0430\u043b\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043f\u044f\u0442\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u0446\u0438\u043a\u043b\u0430 \u043e \u0440\u0435\u0448\u0435\u043d\u0438\u0438 Check Point SandBlast Agent Management Platform. \u0421 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u043c\u0438 \u0441\u0442\u0430\u0442\u044c\u044f\u043c\u0438 \u043c\u043e\u0436\u043d\u043e \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u044c\u0441\u044f, \u043f\u0435\u0440\u0435\u0439\u0434\u044f \u043f\u043e \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u0441\u0441\u044b\u043b\u043a\u0435: \u043f\u0435\u0440\u0432\u0430\u044f, \u0432\u0442\u043e\u0440\u0430\u044f, \u0442\u0440\u0435\u0442\u044c\u044f, \u0447\u0435\u0442\u0432\u0451\u0440\u0442\u0430\u044f. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0432 Management Platform, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0443 \u0441 \u043b\u043e\u0433\u0430\u043c\u0438, \u0438\u043d\u0442\u0435\u0440\u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c\u0438 \u0434\u0430\u0448\u0431\u043e\u0440\u0434\u0430\u043c\u0438 (View) \u0438 \u043e\u0442\u0447\u0451\u0442\u0430\u043c\u0438. \u0422\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0435\u043c \u0442\u0435\u043c\u0443 Threat Hunting \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0433\u0440\u043e\u0437 \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":92914,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-92913","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd475. Check Point SandBlast Agent Management Platform. Logid, Aruanded ja Forensics. Threat Hunting | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd475. Check Point SandBlast Agent Management Platform. Logs, Reports & Forensics. Threat Hunting | ProHoster","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/5-check-point-sandblast-agent-management-platform-logs-reports-forensics-threat-hunting","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-01T11:42:56+00:00","article:modified_time":"2020-09-01T11:42:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"92913","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:58:25","updated":"2022-09-30 07:34:54","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/92913","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=92913"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/92913\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/92914"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=92913"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=92913"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=92913"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}